VulnerabilityPublished 18 Oct 2026

CVE-2026-98713: Linux kernel · KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT

Source GCVE Database

Authoritative record:CVE-2026-98713

Not known to be exploited · fixed in af3300b3a6bace925a496f3520e171c07b999c72 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in af3300b3a6bace925a496f3520e171c07b999c72, 1113374a17d7f7d16b02ee0bbd9b1e7a60cbb087, 4bdd2b3a708c1feb701cb8b62feb8ad2fd77bb07 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-854r-xw42-gj8x

What to do

Upgrade Linux kernel to af3300b3a6bace925a496f3520e171c07b999c72, 1113374a17d7f7d16b02ee0bbd9b1e7a60cbb087, 4bdd2b3a708c1feb701cb8b62feb8ad2fd77bb07 or 2f4a15c52a552c5244ec27f4ca8bda855594f918.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f, < af3300b3a6bace925a496f3520e171c07b999c72	Fixed in af3300b3a6bace925a496f3520e171c07b999c72
LinuxLinux	Affected ≥ f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f, < 1113374a17d7f7d16b02ee0bbd9b1e7a60cbb087	Fixed in 1113374a17d7f7d16b02ee0bbd9b1e7a60cbb087
LinuxLinux	Affected ≥ f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f, < 4bdd2b3a708c1feb701cb8b62feb8ad2fd77bb07	Fixed in 4bdd2b3a708c1feb701cb8b62feb8ad2fd77bb07
LinuxLinux	Affected ≥ f5a5a406b4b8bb6c1fc7a1e92a872bd86061a53f, < 2f4a15c52a552c5244ec27f4ca8bda855594f918	Fixed in 2f4a15c52a552c5244ec27f4ca8bda855594f918
LinuxLinux	Affected =6.9	Fixed in–

AI-suggested

A fix for this vulnerability has been applied in the Linux kernel. Users should update to the kernel version containing this patch to resolve the issue. No additional mitigation actions are required beyond applying the official fix.

Description

A vulnerability in the Linux kernel's KVM arm64 implementation related to fine-grained undefined instruction (UNDEF) handling without FEAT_FGT has been resolved. The issue involved incorrect gating of fine-grained trap (FGT) configuration insertion, which could cause spurious warnings and improper trap handling in certain hardware configurations. The fix ensures that fine-grained undefined instruction traps (FGUs) are always applied correctly regardless of hardware support for FEAT_FGT, preventing unexpected behavior during virtualization.

References

Community reviews

Loading reviews…