CVE-2026-98715

Received Received - Intake

TLB Control Preservation Flaw in Linux Kernel KVM

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN, as empirical testing shows that the CPU performs the requested TLB flush if and only if VMRUN is successful, i.e. clearing TLB control on a failed VMRUN effectively drops a TLB flush. Explicitly track the need to flush all ASIDs on a per-CPU basis, as the ASID reuse condition is tied to the pCPU, not to the vCPU. As a bonus, this also obviates the need to avoid clobbering FLUSH_ALL_ASID with TLB_CONTROL_FLUSH_ASID, e.g. in svm_flush_tlb_asid(). Deliberately don't bother saving/restoring the "old" tlb_ctl on failure, in quotes because it's not exactly the old tlb_ctl, it's the tlb_ctl from after pre_svm_run(), but before updating tlb_ctl for flush_all_asids. If VMRUN fails and TLB_CONTROL_FLUSH_ALL_ASID is forced, then the next successful run of the VMCB *may* unnecessarily flush all ASIDs, which strictly speaking could result in noisy neighbor issues. However, the fact that new_asid() is already guest-triggerable, because of KVM's flawed behavior of clearing the ASID on emulated INIT, means that a guest can already trigger a flush of all ASIDs at roughly the same rate. And once KVM stops clobbering the ASID on emulated INIT, *or* assigns a static ASID to each vCPU, this flaw goes away.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98715

EUVD

EUVD-2026-103969

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	38e5e92fe8c02a8766459d505423b855caf9af1f
Linux	Linux	38e5e92fe8c02a8766459d505423b855caf9af1f
Linux	Linux	2.6.38

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the KVM (Kernel-based Virtual Machine) subsystem for AMD's Secure Virtual Machine (SVM) architecture. When a VMRUN instruction fails, the kernel incorrectly resets the TLB (Translation Lookaside Buffer) control to a state that drops a pending TLB flush. This means the CPU may not perform the required TLB flush, potentially leading to inconsistent memory access between virtual machines and the host.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM SVM implementation and requires kernel-level inspection. Detection involves checking kernel logs for TLB flush anomalies or failed VMRUN events. Use commands like 'dmesg | grep -i kvm' or 'journalctl -k | grep -i svm' to review kernel messages for related errors.

Impact Analysis

This vulnerability could allow a guest virtual machine to cause memory corruption or denial-of-service conditions on the host system. It may lead to crashes, data corruption, or privilege escalation if exploited by an attacker controlling a guest VM. Systems running virtualized workloads on affected Linux kernels are at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue related to TLB control in KVM's SVM implementation, which could lead to minor performance or stability issues but does not involve data breaches or unauthorized access.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Monitor for TLB flush-related performance degradation or guest-triggerable ASID flushes. If using virtualization, ensure hypervisor and guest OS are updated to versions containing the fix.

Hi! I’m here to help you understand CVE-2026-98715. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70