UBUNTU-CVE-2026-98164: High severity ubuntu/linux-aws vulnerability
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvmgfniswritetracked() checks only the supplied memslot, but page tracking is per-address-space and shadow pages are shared across all address spaces. With SMM, a GFN can therefore be write-tracked in one address space and appear untracked through the other. Check the supplied slot first, then the slot for the other address space. This ensures all callers honor write tracking regardless of the active address space. In particular, it prevents mmutrytounsyncpages() from marking an upper-level shadow page unsync and eventually triggering the BUG in ptelistremove(). [invert direction of the conditional. - Paolo]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running an affected Ubuntu kernel package are in scope, including linux, linux-aws, linux-azure, linux-gcp, and the listed FIPS variants. The vulnerable code is in KVM's x86 MMU handling, so exposure depends on use of KVM virtualization on x86.
What conditions are needed to trigger the flaw?
The issue involves System Management Mode (SMM), multiple KVM address spaces, and page write tracking. A locally accessible attacker requires no privileges or user interaction according to the supplied vector, but the description does not identify a specific guest workload or trigger sequence.
What is the likely impact if exploited?
Incorrect write-tracking handling can cause KVM to mark an upper-level shadow page unsynchronized and eventually trigger a BUG in pte_list_remove(). The supplied vector indicates high availability impact, including subsequent-system availability impact, with no stated confidentiality or integrity impact.
How can I determine whether I may be affected?
Check whether the host is running one of the listed Ubuntu kernel package families and uses KVM on x86. The provided data does not include fixed package versions or a runtime detection method.