CVE-2026-98713: KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Apply the fine-grained UNDEFs without FEATFGT
FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvmcalculatetraps() already computes the FGU bits with or without FEATFGT.
This also fixes a spurious WARN when a TLBI OS is run on a guest in vEL1 without FEATTLBIOS on non FEATFGT hardware. In this configuration the course-grained HCREL2.TTLBOS trap reaches the handler handletlbiel1(), which expects an EL1 TLBI only from vEL2. With FGUs enabled the UNDEF will be injected without needing the specific handler.
[oliver: Take Wei-Lin's suggested changelog]
Affected Software
Event History
Frequently Asked Questions
Which environments are affected by the spurious warning condition?
The described condition occurs when a TLBI OS is run by a guest at vEL1 without FEAT_TLBIOS on hardware that does not implement FEAT_FGT. In that configuration, the coarse-grained HCR_EL2.TTLBOS trap reaches a handler that expects an EL1 TLBI only from vEL2.
Does the host CPU need FEAT_FGT for fine-grained UNDEF handling to work?
No. The fix states that fine-grained UNDEFs do not require hardware FEAT_FGT support, and the trap-calculation logic already computes the relevant FGU bits whether or not FEAT_FGT is present.
What behavior does the fix provide for unsupported guest TLBI operations?
It enables fine-grained UNDEF configuration even without FEAT_FGT hardware. This causes the unsupported operation to receive an injected UNDEF instead of relying on the specific TLBI handler path that can produce the spurious warning.