In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode… (CVE-2026-98470)

The Linux kernel's KVM arm64 code had a vulnerability where kvm_pkvm_ioctl_allowed() would WARN when kvm_get_cap_for_kvm_ioctl() failed to find an ioctl number in vm_ioctl_caps[]. The function kvm_arch_vm_ioctl() calls this for every ioctl number not handled by generic code. As a result, userspace could invoke ioctl(vm_fd, 0xdeadbeef) with an unknown ioctl number, causing a WARN that taints the protected KVM (pKVM) host and can lead to a kernel panic if panic_on_warn is enabled. The lookup uses userspace input, but returns false and -EINVAL for unknown ioctl numbers on hosts without pKVM, preventing further impact.

Userspace can cause the kernel to WARN and potentially panic on pKVM hosts by issuing unknown ioctl commands, leading to denial of service. The host becomes tainted, which may affect debugging and stability. On hosts without pKVM, the ioctl simply returns an error without causing a panic.

A fix has been applied to the Linux kernel to resolve this issue. Users should update to the patched kernel version once available. No additional mitigation is required beyond applying the official fix.