CVE-2026-98471

Received Received - Intake

Cache Maintenance Flaw in Linux Kernel KVM SEV

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM during intra-host migration Manually perform cache maintenance on the source VM during intra-host migration to ensure no stale data is left in CPU caches after the VM is destroyed. Because the source VM is "converted" to a non-SEV VM, KVM's memory reclaim flows won't trigger cache maintenance, e.g. when all guest memory is reclaimed in response to detaching from the mmu_notifier. Note, relying on the destination VM to do cache maintenance isn't an option as KVM doesn't require identical guest memory configurations, i.e. the source VM may have access to memory that the destination VM does not. Enforcing equivalent memory configurations is infeasible, as it would require a *deep* comparison of memslots, e.g. to verify that not only are the memslot identical, but what the memslots point at is also identical.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98471

EUVD

EUVD-2026-103711

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	b56639318bb2be66aceba92836279714488709b4
Linux	Linux	b56639318bb2be66aceba92836279714488709b4
Linux	Linux	b56639318bb2be66aceba92836279714488709b4
Linux	Linux	5.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a security issue during intra-host migration of virtual machines (VMs) using AMD's Secure Encrypted Virtualization (SEV). When a VM is migrated within the same host, cache maintenance is not performed on the source VM, potentially leaving stale data in CPU caches after the VM is destroyed. This happens because the source VM is converted to a non-SEV VM, and KVM's memory reclaim flows do not trigger the necessary cache cleaning.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM SEV implementation and requires kernel-level inspection. Detection involves checking kernel logs for SEV-related errors during VM migration or examining kernel parameters related to cache maintenance. Commands like dmesg | grep -i sev or checking /proc/cpuinfo for SEV support may help identify affected systems.

Impact Analysis

This vulnerability could allow unauthorized access to sensitive data if an attacker exploits the stale cache data left behind after a VM migration. Attackers might recover confidential information from the CPU caches, potentially leading to data breaches or unauthorized system access.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA, as it may result in unauthorized exposure of personal or sensitive data. Organizations using affected Linux kernel versions must address this issue to maintain compliance with these standards.

Mitigation Strategies

Apply the latest Linux kernel patches that address this KVM SEV cache maintenance issue to ensure proper cleanup during intra-host VM migration.

Hi! I’m here to help you understand CVE-2026-98471. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70