CVE-2026-98637

Received Received - Intake

KVM: arm64 VM-wide SVE Feature Preservation on vCPU Init Failure

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure pkvm_vcpu_init_sve() clears KVM_ARM_VCPU_SVE in kvm->arch.vcpu_features when it fails, but vcpu_has_sve() tests KVM_ARCH_FLAG_GUEST_HAS_SVE, which is left set. Later vCPUs on that VM then skip the SVE setup and register with a NULL sve_state, which the guest's first FP access hands to sve_load_state(). Return the error without touching vcpu_features.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98637

EUVD

EUVD-2026-103551

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	5db1bef933427aa467ad89c7b695a84a6b4afe16
Linux	Linux	5db1bef933427aa467ad89c7b695a84a6b4afe16
Linux	Linux	5db1bef933427aa467ad89c7b695a84a6b4afe16
Linux	Linux	6.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability affecting KVM for arm64 systems. When initializing a virtual CPU (vCPU) fails, the system incorrectly clears a feature flag but leaves another flag set. This causes subsequent vCPUs to skip proper SVE (Scalable Vector Extension) setup, leading to a NULL state that crashes when the guest tries to use floating-point operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation for arm64. Detection requires checking kernel logs for SVE-related errors during vCPU initialization or guest FP access failures. Use commands like dmesg | grep -i sve or journalctl -k | grep -i sve to search for related errors.

Impact Analysis

If you use KVM virtualization on arm64 systems, this flaw could cause guest VMs to crash during FP operations. It may lead to denial of service for virtual machines relying on SVE instructions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue related to KVM virtualization on arm64 systems. It may indirectly impact compliance if virtualized environments are used to process regulated data, but no specific compliance implications are described in the provided context.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch this issue. If immediate patching is not possible, avoid using KVM virtualization on arm64 systems until the fix is applied. Monitor kernel logs for SVE-related errors as a sign of exploitation.

Hi! I’m here to help you understand CVE-2026-98637. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70