CVE-2026-98433: KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure

CVE-2026-98433: KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure

In kvmppc_svm_page_in(), if uv_page_in() fails after
kvmppc_uvmem_get_page() has succeeded, the secure device page is never
released.  kvmppc_uvmem_get_page() sets a bit in kvmppc_uvmem_bitmap,
allocates a kvmppc_uvmem_page_pvt struct, marks the GFN as
KVMPPC_GFN_UVMEM_PFN, and calls zone_device_page_init() which sets
refcount=1 and locks the page.  The subsequent goto out_finalize skips
the *mig.dst assignment, so migrate_vma_finalize() is a no-op for the
page, and none of those resources are ever reclaimed.

Each occurrence permanently consumes one entry from the firmware-bounded
secure memory pool (kvmppc_uvmem_bitmap), leaks pvt, and leaves the GFN
marked as secure — making it unusable for the lifetime of the VM.

The twin __kvmppc_svm_page_out() already handles the analogous uv_page_out()
failure correctly with unlock_page(dpage); __free_page(dpage).  Apply
the same pattern here: unlock_page() followed by put_page(), which
chains through free_zone_device_folio() into kvmppc_uvmem_folio_free()
to clear the bitmap bit, free pvt, and reset the GFN state.

Reachable whenever uv_page_in() returns an error (e.g. UV pool
exhaustion) on any POWER9/10 + Ultravisor/PEF system.

The Linux kernel CVE team has assigned CVE-2026-98433 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 5.10.271 with commit ed2f2ff63cb7e71204096e765c6d02c3b6974b95
	Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 5.15.222 with commit 8f3b7746874b39fc20e0363c9076c7787d4765ba
	Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 6.1.189 with commit a933d7024359e2e566b07903d1294b84f90482ae
	Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 6.6.158 with commit c41088b2765af1e97e7bb05f906ae1823eca0388
	Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 6.12.112 with commit f3d4b2fc30c97cf8e6f8b880d2de9c17ecac7f5b
	Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 6.18.54 with commit dfb84274932737e338ff5eb27f34b4c8ecb01b50
	Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 7.2.8 with commit fcbff8008b0e08cd53b611bd0ff7e01f5b962f80
	Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 7.3-rc4 with commit 0a416ee20bcccddf91ca5b63696a23b9d11d73aa

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-98433
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/powerpc/kvm/book3s_hv_uvmem.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ed2f2ff63cb7e71204096e765c6d02c3b6974b95
	https://git.kernel.org/stable/c/8f3b7746874b39fc20e0363c9076c7787d4765ba
	https://git.kernel.org/stable/c/a933d7024359e2e566b07903d1294b84f90482ae
	https://git.kernel.org/stable/c/c41088b2765af1e97e7bb05f906ae1823eca0388
	https://git.kernel.org/stable/c/f3d4b2fc30c97cf8e6f8b880d2de9c17ecac7f5b
	https://git.kernel.org/stable/c/dfb84274932737e338ff5eb27f34b4c8ecb01b50
	https://git.kernel.org/stable/c/fcbff8008b0e08cd53b611bd0ff7e01f5b962f80
	https://git.kernel.org/stable/c/0a416ee20bcccddf91ca5b63696a23b9d11d73aa