From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9728A318146 for ; Sun, 18 Oct 2026 14:40:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792334460; cv=none; b=JlGie2ePotpvpB45aR0/ZCnc7njbkKO0rqPuqUcjyFpgU0vOBWNzw4xxN3l7GlzWqtkvTjz0fuBb7jIrcmd/0ZSf7DArAHwC+f2CCiQv6gzNd8HQlY+Pte3Yb2Ew7JormQgfQ50XccPxEnIWIwfbf2PUz7jt+pktY3GhLjwxbOs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792334460; c=relaxed/simple; bh=hmCOBW95BMTGJ3ztnmbiuA0w0f9qwmEGo+2WoKFdkT0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=uJGCbhrMy11USc852RDSVPDwSZ3d8pzudjmZflo5Y9hu8VJWKwhuKtOCK6F25JdoLonhlI6ua+AysYVlcykhxsgk4tJzsNoVHyfwcTLnoSXdn67DWAdl1OqT3rwDMQhLRo2ZHL2UDCUdhQRwIk8WA7IyvohEz9ikeY+XmBfud00= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xMRe72V+; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="xMRe72V+" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 377BD1F000C4; Sun, 18 Oct 2026 14:40:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792334459; bh=Q34zWlFIUqsKRZYraxJcm17UayylvutSlHpaTJhqI/g=; h=From:To:Cc:Subject:Date:Reply-To; b=xMRe72V+4Bxkgo2jkTKC34mIY2rdkEvpldyLcEVjISPRKG6EaNnvH740eFhSIUswE k8WlhuTfhb0FrW8SpNw5U4DGUd6amI9FFHr3XoR9xpr/msuWSsJGgqVPLFNipv/nUm EQdbKDob8meENyB5znZre1wLcd1rCdbHPmnJA5fs= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98433: KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure Date: Sun, 18 Oct 2026 16:40:10 +0200 Message-ID: <2026101810-CVE-2026-98433-166c@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4373; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=qTfxbmXK1zcqVDnYSBxaKpJRfqZxA1GJ99l+mZp5eyM=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlXbnlxa3ArR56IWnDCKfev5tPUteLTzdtnqUT/CBE/0 ndWifdxRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEyE+xLDfD85v66nkUcO6eQ3 VCosMjrDI+1xmGF+1Z2O21yOP9R9Iz4EF/7ap+f4P/YkAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure In kvmppc_svm_page_in(), if uv_page_in() fails after kvmppc_uvmem_get_page() has succeeded, the secure device page is never released. kvmppc_uvmem_get_page() sets a bit in kvmppc_uvmem_bitmap, allocates a kvmppc_uvmem_page_pvt struct, marks the GFN as KVMPPC_GFN_UVMEM_PFN, and calls zone_device_page_init() which sets refcount=1 and locks the page. The subsequent goto out_finalize skips the *mig.dst assignment, so migrate_vma_finalize() is a no-op for the page, and none of those resources are ever reclaimed. Each occurrence permanently consumes one entry from the firmware-bounded secure memory pool (kvmppc_uvmem_bitmap), leaks pvt, and leaves the GFN marked as secure — making it unusable for the lifetime of the VM. The twin __kvmppc_svm_page_out() already handles the analogous uv_page_out() failure correctly with unlock_page(dpage); __free_page(dpage). Apply the same pattern here: unlock_page() followed by put_page(), which chains through free_zone_device_folio() into kvmppc_uvmem_folio_free() to clear the bitmap bit, free pvt, and reset the GFN state. Reachable whenever uv_page_in() returns an error (e.g. UV pool exhaustion) on any POWER9/10 + Ultravisor/PEF system. The Linux kernel CVE team has assigned CVE-2026-98433 to this issue. Affected and fixed versions =========================== Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 5.10.271 with commit ed2f2ff63cb7e71204096e765c6d02c3b6974b95 Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 5.15.222 with commit 8f3b7746874b39fc20e0363c9076c7787d4765ba Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 6.1.189 with commit a933d7024359e2e566b07903d1294b84f90482ae Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 6.6.158 with commit c41088b2765af1e97e7bb05f906ae1823eca0388 Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 6.12.112 with commit f3d4b2fc30c97cf8e6f8b880d2de9c17ecac7f5b Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 6.18.54 with commit dfb84274932737e338ff5eb27f34b4c8ecb01b50 Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 7.2.8 with commit fcbff8008b0e08cd53b611bd0ff7e01f5b962f80 Issue introduced in 5.5 with commit ca9f4942670c37407bb109090eaf776ce2ccc54c and fixed in 7.3-rc4 with commit 0a416ee20bcccddf91ca5b63696a23b9d11d73aa Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98433 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/powerpc/kvm/book3s_hv_uvmem.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/ed2f2ff63cb7e71204096e765c6d02c3b6974b95 https://git.kernel.org/stable/c/8f3b7746874b39fc20e0363c9076c7787d4765ba https://git.kernel.org/stable/c/a933d7024359e2e566b07903d1294b84f90482ae https://git.kernel.org/stable/c/c41088b2765af1e97e7bb05f906ae1823eca0388 https://git.kernel.org/stable/c/f3d4b2fc30c97cf8e6f8b880d2de9c17ecac7f5b https://git.kernel.org/stable/c/dfb84274932737e338ff5eb27f34b4c8ecb01b50 https://git.kernel.org/stable/c/fcbff8008b0e08cd53b611bd0ff7e01f5b962f80 https://git.kernel.org/stable/c/0a416ee20bcccddf91ca5b63696a23b9d11d73aa