CVE-2026-98282

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bad ioba/npages values come from a KVM guest's H_STUFF_TCE or H_PUT_TCE_INDIRECT hypercall registers. book3s_hv.c passes them to kvmppc_h_stuff_tce()/kvmppc_h_put_tce_indirect(), which call kvmppc_ioba_validate() -> iommu_tce_check_ioba(). The attacker is code running on the host in a guest, not a remote network peer.

AC:LAttack complexity, low

The guest picks liobn, ioba (the last valid entry) and npages itself. The flawed check only tests ioba+1, so every such hypercall reliably walks kvmppc_tce_put() past stt->size. No race or outside condition is involved; only heap grooming affects how far exploitation goes.

PR:LPrivileges required, low

The attacker needs kernel privilege inside their own guest, which any tenant of a pseries KVM VM has. Relative to the host, that is a low-privilege tenant position. The guest's TCE table already exists because QEMU creates it through KVM_CREATE_SPAPR_TCE_64 for the default PHB/VIO DMA windows.

UI:NUser interaction, none

The guest issues the hypercalls whenever it wants. No action by the host administrator or any other user is needed.

S:CScope, changed

A guest-controlled hypercall corrupts host kernel memory and touches the host's hardware IOMMU table outside the guest's DMA window. The impact therefore crosses the guest-to-host virtualization boundary.

C:HConfidentiality impact, high

kvmppc_tce_put() and kvmppc_h_get_tce paths index stt->pages[] past the kmalloc'd flexible array, and the TCE iommu_unmap/map paths use entries beyond the window. This gives out-of-bounds access to host heap and IOMMU state that can be turned into host memory disclosure.

I:HIntegrity impact, high

In H_STUFF_TCE, npages is unbounded and tce_value is guest-chosen. kvmppc_tce_put() writes that 8-byte value through an out-of-bounds stt->pages[] pointer, or stores a newly allocated page pointer into the out-of-bounds slot. Both are host heap writes.

A:HAvailability impact, high

Dereferencing an out-of-bounds stt->pages[] entry as a struct page, or corrupting the host heap and IOMMU tables, crashes or oopses the host. That takes down every VM running on it.