CVE-2026-98164

Executive Summary

CVE-2026-98164 is a logic flaw in the Linux kernel KVM x86 memory management unit (MMU) write-tracking logic. The function kvm_gfn_is_write_tracked() only inspects the caller-supplied memory slot, but page tracking is maintained per-address-space while shadow pages are shared across all address spaces. When System Management Mode (SMM) is active, a guest-physical frame number (GFN) can be write-tracked in one address space yet appear untracked through the other, causing inconsistent MMU state. The most severe outcome described is a kernel BUG (host panic/denial of service) reached via mmu_try_to_unsync_pages() marking an upper-level shadow page unsync and later tripping an assertion in pte_list_remove(). As reported in the supplied NVD description, the issue is a kernel-level denial-of-service risk in hosts running KVM with SMM-exposed guests.

Technical Analysis

The vulnerability resides in KVM's x86 MMU write-tracking bookkeeping. Write tracking is used by KVM to detect when a guest writes to a page that the hypervisor has temporarily made read-only for internal reasons (for example, dirty logging or structural MMU synchronization). The NVD description states that kvm_gfn_is_write_tracked() "checks only the supplied memslot," but "page tracking is per-address-space and shadow pages are shared across all address spaces."

This creates a consistency gap. On x86, KVM maintains more than one address space (for example, the normal guest address space and the separate SMM address space). Because shadow pages are shared between these address spaces, a GFP can be tracked in one address space and untracked in the other while referencing the same underlying shadow structure. Consequently, a query routed through the "wrong" memslot returns a false negative for write tracking, despite the page genuinely being tracked in the other address space.

The described consequence is a broken MMU state transition. When the check returns an incorrect untracked result, mmu_try_to_unsync_pages() may proceed to mark an upper-level shadow page as unsync. The report states this can "eventually trigger the BUG in pte_list_remove()" — an assertion failure in KVM's reverse-mapping (rmap) list handling. Triggering that BUG in kernel context produces a host-side kernel error, which in typical deployments results in a panic or an unrecoverable KVM subsystem fault.

The fix direction described is to "check the supplied slot first, then the slot for the other address space," so that callers honor write tracking regardless of the active address space. The description also notes a maintainer-directed revision: "[invert direction of the conditional. - Paolo]," indicating the final merged conditional ordering was adjusted during review.

Key technical facts strictly supported by the source:

• Affected function: kvm_gfn_is_write_tracked().
• Root cause class: incorrect scope of a per-address-space check (logic/control-flow error; approximated as CWE-670).
• Interaction required: SMM address space with shared shadow pages.
• Propagation path: mmu_try_to_unsync_pages() → unsync marked on an upper-level shadow page.
• Failure site: BUG in pte_list_remove().
• Remediation shape: consult both the supplied memslot and the other address space's memslot.

No CVE-specific function bodies, register names, or IOCTL parameters beyond those quoted are provided, so no further implementation detail is asserted.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is known for this CVE. The attack chain below is inferred from the vulnerability class (kernel MMU logic error reachable through guest-controlled activity) and the explicit mechanism named in the NVD description. It does not rely on invented function names or endpoints.

1. Reconnaissance / target identification. An attacker first determines whether a target is a KVM host exposing a guest with SMM available. This typically means an environment where nested/guest virtual machines are provisioned and SMM is enabled for the guest. The attacker who controls guest execution (for example a tenant in a multi-tenant virtualization platform, or a workload operator) is positioned to influence guest MMU behavior without needing host credentials.

2. Triggering the specific flaw. The attacker drives guest activity that forces concurrent use of the two address spaces around the tracked GFN. Because shadow pages are shared but tracking is per-address-space, the attacker needs the GFN to be write-tracked in one address space and observed through the other. This is a race/state-consistency condition rather than a memory-corruption primitive. The attacker does not need a malformed packet or crafted syscall payload; the trigger is guest MMU/SMM activity that causes kvm_gfn_is_write_tracked() to be consulted against a memslot whose address space does not reflect the tracking state.

3. Execution method at the vulnerability-class level. There is no payload injection step described. The "execution" is the state divergence itself: the false untracked result allows mmu_try_to_unsync_pages() to mark an upper-level shadow page unsync. The attacker's leverage is behavioral — arranging the guest to hit the window where tracking state is split across address spaces.

4. Post-exploitation impact. Per the description, the terminal effect is the BUG in pte_list_remove(), i.e., a host kernel assertion failure. This is a denial-of-service against the KVM host or the affected guest domain (host panic / VM teardown), not a documented path to confidentiality or integrity compromise. No privilege escalation, code execution, or data exfiltration is described in the source. Any claim of memory corruption or escape beyond the described BUG would be speculative and is not supported here.

Impact Assessment

The headline impact is availability. The described failure is a kernel BUG reachable through normal KVM/SMM guest operation, which in production translates to a host panic or forced VM termination — a denial-of-service condition affecting all guests on the impacted host, not just the one triggering it. Integrity and confidentiality impact are not described: the flaw produces incorrect bookkeeping and an assertion failure rather than an out-of-bounds write or control-flow hijack in the supplied text.

Scope is the KVM subsystem on x86 Linux hosts that expose SMM to guests. Blast radius is determined by tenant/guest density on the hypervisor: a single offending guest can degrade or take down co-resident workloads through host-level panic. Because the condition is a race between address-space tracking states, exploitation reliability is likely probabilistic and favors resource-controlling guests.

The supplied data provides no CVSS score (score: N/A) and no CVSS vector, and EPSS has not been scored. The vector shown in METADATA is an analyst-derived placeholder for a local, high-complexity, high-privilege, availability-only condition and must not be presented as an authoritative published score. The absence of a CNA-assigned CVSS score, CWE, vendor fix, and affected-version list means impact must be qualified: severity cannot be numerically ranked from official sources at this time. CISA KEV enrollment is negative, and no exploit code or PoC is known, which lowers near-term risk of opportunistic attack but does not eliminate the underlying DoS potential in SMM-enabled KVM environments.

Detection Guidance

Detection for this class of issue is challenging because it is an internal kernel logic bug rather than a network-visible exploit. The rules below target the observable host-side symptoms (KVM BUG/panic signatures, SMM-related kernel messages) and the absence of direct exploit telemetry is acknowledged.

Sigma Rule

title: Linux Kernel KVM MMU Write-Tracking Consistency Failure (CVE-2026-98164)
id: 9f3c1a2e-7b64-4c1d-9a10-5e2b8c0d4f11
status: experimental
description: Detects host kernel messages consistent with a KVM MMU shadow page assertion failure potentially related to write-tracking inconsistency (CVE-2026-98164).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98164
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: kernel
detection:
  keywords:
    - "BUG"
    - "pte_list_remove"
    - "kvm_gfn_is_write_tracked"
    - "mmu_try_to_unsync_pages"
  condition: selection
  selection:
    - "pte_list_remove"
    - "mmu_try_to_unsync_pages"
fields:
  - host
  - message
level: high
tags:
  - attack.t1190

YARA Rule

rule CVE_2026_98164_KVM_MMU_Writetrack
{
    meta:
        author = "Threat Intelligence"
        description = "Detects kernel crash-dump/log artifacts referencing KVM MMU write-tracking failure symbols for CVE-2026-98164"
        cve = "CVE-2026-98164"
        severity = "high"
    strings:
        $a = "kvm_gfn_is_write_tracked"
        $b = "mmu_try_to_unsync_pages"
        $c = "pte_list_remove"
    condition:
        (uint32(0) == 0x464c457f or true) and 2 of them
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-98164 Linux KVM MMU write-tracking consistency issue - host DoS indicator"; content:"pte_list_remove"; nocase; threshold: type limit, track by_src, count 1, seconds 60; classtype:attempted-dos; sid:202698164; rev:1;)

Elastic Detection

process where event.type == "start" and process.name == "kernel" and
  process.args : ("*pte_list_remove*", "*mmu_try_to_unsync_pages*", "*kvm_gfn_is_write_tracked*")

Splunk SPL Query

index=linux host=* source=*kern* OR source=*messages*
( "pte_list_remove" OR "mmu_try_to_unsync_pages" OR "kvm_gfn_is_write_tracked" OR "KVM: x86/mmu" )
| stats count min(_time) as firstSeen max(_time) as lastSeen by host, message
| where count > 0

Wazuh OSSEC Rule

<group name="linux,kvm,cve-2026-98164,">
  <rule id="100164" level="12">
    <decoded_as>syslog</decoded_as>
    <match>pte_list_remove|mmu_try_to_unsync_pages|kvm_gfn_is_write_tracked</match>
    <description>CVE-2026-98164: KVM MMU write-tracking assertion / shadow page failure detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list was provided in the source data.

1. Immediate mitigations

• Reduce reliance on SMM in guest configurations where it is not strictly required, since the described trigger condition involves the SMM address space interacting with shared shadow pages. Validate that disabling SMM for guest workloads is compatible with your platform before applying.
• Isolate untrusted or high-churn tenants from shared KVM hosts where practical, to limit the blast radius of a host-level assertion failure to a smaller set of workloads.
• Increase host monitoring for KVM subsystem BUGs and kernel panics; tune the detection rules above to alert on pte_list_remove, mmu_try_to_unsync_pages, and kvm_gfn_is_write_tracked messages.
• Ensure kernel crash dumps and KVM logs are retained to characterize any occurrence.

2. Patch / upgrade steps

• Because no patch evidence exists from any tracked source and patch confidence is 0/4, there is no verified upstream commit or stable-version reference to cite. Do not assume any current release contains a fix.
• Track the upstream Linux kernel KVM x86 MMU change that implements the described correction — "Check the supplied slot first, then the slot for the other address space" in kvm_gfn_is_write_tracked() — and apply it once it is available and backported by your distribution. Confirm with your distributor that the stable/longterm tree you consume includes the fix before declaring remediation complete.
• After applying any kernel update, reboot the host and verify the kernel version, then continue watching logs for the BUG signature to confirm the condition no longer reproduces.

3. Long-term hardening

• Maintain a disciplined kernel patch cadence for virtualization hosts; KVM MMU issues are frequently backported without prominent public advisories.
• Enforce least privilege over hypervisor management planes so that only trusted operators can alter guest/SMM configuration, reducing who can influence the trigger state.
• Adopt per-host resource quotas and proactive health monitoring so a single suspect guest cannot degrade co-tenant availability unnoticed.
• Where compliance dictates, prefer vendor-supported kernel branches with defined backport SLAs over self-managed longterm kernels, to shorten exposure windows for logic bugs like this one.

References

• NVD — CVE-2026-98164: https://nvd.nist.gov/vuln/detail/CVE-2026-98164
• Linux Kernel KVM x86 MMU source (upstream arch/x86/kvm/mmu/ subsystem) — consult the current tree for the kvm_gfn_is_write_tracked() implementation: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
• Linux Kernel CVE/security process documentation: https://www.kernel.org/doc/html/latest/process/security-bugs.html
• CISA Known Exploited Vulnerabilities Catalog (verify CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score currently available for this CVE): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence were provided or identified for CVE-2026-98164. CISA KEV status is negative.