CVE-2026-98714
Received Received - Intake

KVM: SVM Control Field Update Failure on VMRUN

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded Leave control.erap_ctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD: there's no explicit architectural guarantee about the behavior in the presence of VMRUN failures. So the best thing to do would be to assume that if VMRUN fails, the actions requested in the control fields may not have been performed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98714
EUVD
EUVD-2026-103968

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of control fields during a failed virtual machine run operation in the KVM (Kernel-based Virtual Machine) subsystem for AMD processors. When VMRUN fails, the control fields like erap_ctl and clean should not be updated in the VMCS because AMD does not guarantee their behavior in such cases. This could lead to inconsistent state in the virtual machine control structure.

Impact Analysis

This vulnerability may allow a guest virtual machine to cause a denial of service or potentially execute arbitrary code in the host kernel. It could lead to system instability, crashes, or unauthorized access if exploited by a malicious guest user.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this KVM SVM vulnerability. Monitor AMD documentation for any additional guidance on handling VMRUN failures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98714. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart