CVE-2026-98713 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, particularly those using KVM and arm64, should assess exposure and verify the Linux kernel version. Operators managing Linux kernel-based systems need to review and apply patches as recommended. Vulnerability management and security teams should prioritize verifying the Linux kernel version, assessing exposure, and applying patches as recommended by the Linux kernel maintainers.

Why it matters

CVE-2026-98713 is a Linux kernel vulnerability related to KVM and arm64. Defenders should verify the Linux kernel version, assess exposure, and apply patches as recommended.

• Verification of Linux kernel version and patch application is required to prevent potential warnings and ensure proper handling of TLBI OS configurations.
• Defenders should assess exposure in their environments, particularly for systems using KVM and arm64.
• Remediation priority follows from verifying and applying Linux kernel patches as recommended by the maintainers.

Technical summary

The Linux kernel vulnerability (CVE-2026-98713) was resolved by applying fine-grained UNDEFs without FEAT_FGT. This change enables FGUs to always be enabled and fixes a spurious WARN when running a TLBI OS on a guest in vEL1 without FEAT_TLBIOS on non-FEAT_FGT hardware. The fix involves modifying KVM and arm64 configurations to allow FGUs to be always enabled, as kvm_calculate_traps() computes FGU bits with or without FEAT_FGT. This modification prevents potential warnings and ensures proper handling of TLBI OS configurations.

Defensive priority

Defenders should prioritize verifying the Linux kernel version and assessing exposure in their environments.

Recommended defensive actions

• Verify Linux kernel version and assess exposure
• Review and apply patches as recommended by the Linux kernel maintainers
• Monitor for potential warnings and handle TLBI OS configurations
• Perform vulnerability scanning to identify potentially affected systems
• Review system configurations for compliance with security best practices
• Implement compensating controls for exposed systems
• Track and document remediation efforts

Evidence notes

The CVE record and source references provide details on the vulnerability and its resolution. However, additional information on affected versions, exploitation, or remediation may be required for comprehensive risk assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.