[uz56764]

This publishes the original kvmCTF Denial of Service submission for
CVE-2026-98164 on Linux 6.1.74. An L1 guest uses Q35 SMM to make KVM mark an
upper-level shadow EPT page unsync across address spaces; later synchronization
reaches the host pte_list_remove() BUG and panics the host.

The first-stage original.tar.gz is unchanged (SHA-256
b2537cf01b2e1453b5d6ee9fbfbeb572ca687168fd26a78ac732d621fc320221).
The checked-in exploit/6.1.x/exploit is byte-for-byte the ring-0 payload
from that archive. The source, rebuild target, run target, and a step-by-step
explanation are included alongside it.

The upstream fix is
0f38453cdb2e,
included in Linux 7.2. The issue is assigned
CVE-2026-98164 and was
disclosed through oss-security.

Validation performed for this PR:

• The copied original archive and frozen payload match their recorded SHA-256
  values (make verify).
• make -B exploit builds the payload from the included source snapshot in a
  disposable copy. The frozen binary remains the one from the original
  submission; a rebuild can differ byte-for-byte with the toolchain.
• The final first-stage artifact produced a Host Crash in both official
  kvmCTF runs (2/2).

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.