CVE-2026-98249: linux

CVSS: UnknownReceived
AliasesUBUNTU-CVE-2026-98249DEBIAN-CVE-2026-98249
Published 06-10-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-98249 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.2% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.18%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:12131-1

Timeline

  1. 06-10-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc swsusp_arch_suspend_exit() reinstalls the restored kernel's hyp stub vectors with an hvc, but never passes the arguments. x0 is not set to HVC_SET_VECTORS and x1 is not set to the vector address, so the stub dispatch falls through and returns without writing vbar_el2. EL2 is left pointing at the trans_pgd copy of the vectors, a page that swsusp_free() releases right after resume. Set the arguments up the same way __hyp_set_vectors() does. Without this fix, Vladimir was able to trigger a hang when resuming from hibernation with CONFIG_PAGE_POISONING=y and page_poison=on.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

06-10-202621-10-2026
EPSS score
0.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu142 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linuxAll versions (No fix recorded) | < 6.1.190-1 | < 6.12.113-1 | < 7.2.8-1
Linux1 product
  • linux≥ 788bfdd97434982b6d575062581e8e72eea755af, < 6646418d1032cac25110526161f60d255ed08397 | ≥ 788bfdd97434982b6d575062581e8e72eea755af, < 909e92423db7299e0206232051aa21fe129f65d0 | ≥ 788bfdd97434982b6d575062581e8e72eea755af, < 60a3c319f1127c4d247d4ed235c5d65376d5e745 | ≥ 788bfdd97434982b6d575062581e8e72eea755af, < e80ea8118a073a30ebe7a31bd78938c2b1751acc | ≥ 788bfdd97434982b6d575062581e8e72eea755af, < d3f8f773312af69eaf4dda106d76d6d42e4362e5 | ≥ 788bfdd97434982b6d575062581e8e72eea755af, < 955d86e5f3b95b731991fdb84966c50b16314629 | 5.16

3 vendors · 144 products

References

10 links