CVE-2026-98719
Received Received - Intake

Memory Corruption in Linux Kernel KVM SEV

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it Nullify have_run_cpus when freeing the mask, particularly in the error path of __sev_guest_init(), so that KVM doesn't have to subtly use sev->active to track whether or not the mask has been freed. As pointed out by Sashiko, blindly freeing the mask in sev_vm_destroy() results in a double-free if the mask is freed if __sev_guest_init() fails. Throw the logic in a helper as nullifying the pointer is frustratingly difficult and weird due to have_run_cpus being a single-entry array when CPUMASK_OFFSTACK=n. Deliberately don't use CPUMASK_VAR_NULL, as it's not directly assignable when the cpumask is on-stack, e.g. requires using a local variable and a memcpy(), which is beyond ridiculous. Furthermore, while clearing the on-stack bitmask is an unnecessary and arguably unwanted side effect, KVM absolutely relies on '0' being the "null" value given that the struct is zero-allocated. Opportunistically add an alloc() helper to pair with free(); there are just enough call sites to make doing so worthwhile.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98719
EUVD
EUVD-2026-103973

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Linux Linux 6aef7cf800098749ff5d660222efaf6e01e98c09
Linux Linux 9784e5ca91b37b387f3f414af4340c54f7a63566
Linux Linux 12c1f6e03f944e399bd2c88441dca5dc702b95a5
Linux Linux 6.18.55
Linux Linux 7.2.9
Linux Linux 7.3-rc5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a memory management issue in the KVM (Kernel-based Virtual Machine) SEV (Secure Encrypted Virtualization) component. Specifically, it addresses a double-free vulnerability where the 'have run CPUs' mask pointer is not properly nullified when freed, leading to potential use-after-free scenarios if initialization fails.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM SEV (Secure Encrypted Virtualization) implementation. Detection requires checking kernel logs for SEV-related errors or examining the kernel version for affected builds. Commands like 'dmesg | grep -i sev' or 'grep -i sev /var/log/syslog' may reveal issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code in the context of the kernel. It may lead to system crashes or instability if exploited, particularly in virtualized environments using KVM with SEV.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-98719. Reboot the system to apply the update. If using KVM with SEV, verify no active VMs are running during the update. Monitor logs post-update for any SEV-related errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98719. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart