Is there a patch available for CVE-2026-98433?

Yes, a patch is available for CVE-2026-98433. Update the affected software to the latest version immediately.

Linux CVE-2026-98433

EUVD-2026-103671

2026-10-18 Linux

GHSA-3v64-xhg6-868f

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure

In kvmppc_svm_page_in(), if uv_page_in() fails after kvmppc_uvmem_get_page() has succeeded, the secure device page is never released. kvmppc_uvmem_get_page() sets a bit in kvmppc_uvmem_bitmap, allocates a kvmppc_uvmem_page_pvt struct, marks the GFN as KVMPPC_GFN_UVMEM_PFN, and calls zone_device_page_init() which sets refcount=1 and locks the page. The subsequent goto out_finalize skips the *mig.dst assignment, so migrate_vma_finalize() is a no-op for the page, and none of those resources are ever reclaimed.

Each occurrence permanently consumes one entry from the firmware-bounded secure memory pool (kvmppc_uvmem_bitmap), leaks pvt, and leaves the GFN marked as secure - making it unusable for the lifetime of the VM.

The twin __kvmppc_svm_page_out() already handles the analogous uv_page_out() failure correctly with unlock_page(dpage); __free_page(dpage). Apply the same pattern here: unlock_page() followed by put_page(), which chains through free_zone_device_folio() into kvmppc_uvmem_folio_free() to clear the bitmap bit, free pvt, and reset the GFN state.

Reachable whenever uv_page_in() returns an error (e.g. UV pool exhaustion) on any POWER9/10 + Ultravisor/PEF system.

Affected VersionsENISA

Linux ca9f4942670c37407bb109090eaf776ce2ccc54c <a933d7024359e2e566b07903d1294b84f90482ae

Linux patch: 5.15.222

Linux patch: 5.10.271

Linux patch: 6.1.189

Linux 5.5

Linux patch: 0

Linux ca9f4942670c37407bb109090eaf776ce2ccc54c <f3d4b2fc30c97cf8e6f8b880d2de9c17ecac7f5b

Linux ca9f4942670c37407bb109090eaf776ce2ccc54c <c41088b2765af1e97e7bb05f906ae1823eca0388

Linux patch: 6.12.112

Linux ca9f4942670c37407bb109090eaf776ce2ccc54c <ed2f2ff63cb7e71204096e765c6d02c3b6974b95

Linux patch: 7.3-rc4

Linux ca9f4942670c37407bb109090eaf776ce2ccc54c <fcbff8008b0e08cd53b611bd0ff7e01f5b962f80

Linux ca9f4942670c37407bb109090eaf776ce2ccc54c <0a416ee20bcccddf91ca5b63696a23b9d11d73aa

Linux patch: 7.2.8

Linux ca9f4942670c37407bb109090eaf776ce2ccc54c <8f3b7746874b39fc20e0363c9076c7787d4765ba

Linux ca9f4942670c37407bb109090eaf776ce2ccc54c <dfb84274932737e338ff5eb27f34b4c8ecb01b50

Linux patch: 6.18.54

Linux patch: 6.6.158

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 18, 2026 - 16:32 EUVD

CVE Published

Oct 18, 2026 - 14:38 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Data Quality

4 sources

Confidence: Medium

EUVD

CVE.org

EPSS MSRC

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.