« Volver al listado

CVE-2026-98249

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc

swsusp_arch_suspend_exit() reinstalls the restored kernel's hyp stub vectors with an hvc, but never passes the arguments. x0 is not set to HVC_SET_VECTORS and x1 is not set to the vector address, so the stub dispatch falls through and returns without writing vbar_el2. EL2 is left pointing at the trans_pgd copy of the vectors, a page that swsusp_free() releases right after resume.

Set the arguments up the same way __hyp_set_vectors() does.

Without this fix, Vladimir was able to trigger a hang when resuming from hibernation with CONFIG_PAGE_POISONING=y and page_poison=on.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98249",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "788bfdd97434982b6d575062581e8e72eea755af",
              "lessThan": "6646418d1032cac25110526161f60d255ed08397",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "788bfdd97434982b6d575062581e8e72eea755af",
              "lessThan": "909e92423db7299e0206232051aa21fe129f65d0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "788bfdd97434982b6d575062581e8e72eea755af",
              "lessThan": "60a3c319f1127c4d247d4ed235c5d65376d5e745",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "788bfdd97434982b6d575062581e8e72eea755af",
              "lessThan": "e80ea8118a073a30ebe7a31bd78938c2b1751acc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "788bfdd97434982b6d575062581e8e72eea755af",
              "lessThan": "d3f8f773312af69eaf4dda106d76d6d42e4362e5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "788bfdd97434982b6d575062581e8e72eea755af",
              "lessThan": "955d86e5f3b95b731991fdb84966c50b16314629",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "arch/arm64/kernel/hibernate-asm.S"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/arm64/kernel/hibernate-asm.S"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-06T09:18:13.290",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/60a3c319f1127c4d247d4ed235c5d65376d5e745",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6646418d1032cac25110526161f60d255ed08397",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/909e92423db7299e0206232051aa21fe129f65d0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/955d86e5f3b95b731991fdb84966c50b16314629",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d3f8f773312af69eaf4dda106d76d6d42e4362e5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e80ea8118a073a30ebe7a31bd78938c2b1751acc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc\n\nswsusp_arch_suspend_exit() reinstalls the restored kernel's hyp stub\nvectors with an hvc, but never passes the arguments. x0 is not set to\nHVC_SET_VECTORS and x1 is not set to the vector address, so the stub\ndispatch falls through and returns without writing vbar_el2. EL2 is\nleft pointing at the trans_pgd copy of the vectors, a page that\nswsusp_free() releases right after resume.\n\nSet the arguments up the same way __hyp_set_vectors() does.\n\nWithout this fix, Vladimir was able to trigger a hang when resuming from\nhibernation with CONFIG_PAGE_POISONING=y and page_poison=on."
    }
  ],
  "lastModified": "2026-10-06T09:18:13.290",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}