Linux Kernel KVM CVE-2026-98164

Exploitation requires: (1) local access to an x86 host running KVM with the ability to launch/control a VM (PR:L - not remote, not unauthenticated); and (2) use of SMM (System Management Mode) emulation, since the bug stems from page write-tracking being per-address-space while shadow pages are shared across address spaces - a GFN write-tracked in one address space can appear untracked through the other. Limiting factors: the attacker must be able to run KVM guests (/dev/kvm access), the SMM address-space condition must be reached, and the impact is confined to host availability (kernel BUG/crash) with no confidentiality or integrity impact. Hosts without KVM/SMM-capable guest configurations, or without local untrusted VM operators, are not realistically exposed.

This is a genuine-but-low-priority issue. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) describes a local, low-complexity, low-privilege availability-only impact - consistent with a kernel BUG()/crash (denial of service) rather than code execution or data theft. EPSS reinforces low urgency: 0.19% exploitation probability at the 8th percentile. The vulnerability is NOT in CISA KEV and no public exploit code is identified, so there is no public exploit identified at time of analysis. One signal conflict must be noted: the input Tags include 'Information Disclosure', but the CVSS vector sets C:N/I:N and A:H and the description points to a triggered kernel BUG in pte_list_remove() - i.e. a DoS, not information disclosure; the tag appears inaccurate and should not drive triage. Net: a real, patch-worthy correctness bug in KVM shadow-MMU/SMM handling, but low real-world risk because it requires local access with the ability to run KVM guests and yields only a host crash, not privilege escalation or info leak.

A local user (or a malicious guest operator) with permission to create KVM virtual machines on an x86 host configures a guest that exercises System Management Mode so a GFN is write-tracked in one address space but appears untracked through the other; this drives mmu_try_to_unsync_pages() to mark an upper-level shadow page unsync and eventually trips the BUG in pte_list_remove(), crashing the host kernel. No public exploit code is identified at time of analysis, and exploitation is local and low-complexity but availability-only (host DoS).