CVE-2026-98472

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV Unconditionally free SEV's "have run CPUs" cpumask in the VM destroy path, i.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV VM if its state is intra-host migrated. Alternatively, the mask could be freed in sev_migrate_from() when "converting" the source VM, but that gets annoying because ideally KVM would nullify the mask to guard against UAF, and nullifying the mask would need be conditioned on CPUMASK_OFFSTACK=y. Freeing the mask during sev_migrate_from() is also not robust against other KVM bugs, though that's kind of a moot point since any such bugs would show up even if sev->active is never set. I.e. KVM must get that side of things correct. But, that's not a great reason to add more code just to make things marginally less robust.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-10-18 16:16:57.697000

Last modified

2026-10-19 10:18:57.743000

View original CVE JSON

{
  "id": "CVE-2026-98472",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-10-18T16:16:57.697",
  "lastModified": "2026-10-19T10:18:57.743",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV\n\nUnconditionally free SEV's \"have run CPUs\" cpumask in the VM destroy path,\ni.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV\nVM if its state is intra-host migrated.  Alternatively, the mask could be\nfreed in sev_migrate_from() when \"converting\" the source VM, but that gets\nannoying because ideally KVM would nullify the mask to guard against UAF,\nand nullifying the mask would need be conditioned on CPUMASK_OFFSTACK=y.\n\nFreeing the mask during sev_migrate_from() is also not robust against other\nKVM bugs, though that's kind of a moot point since any such bugs would show\nup even if sev->active is never set.  I.e. KVM must get that side of things\ncorrect.  But, that's not a great reason to add more code just to make\nthings marginally less robust."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6f38f8c574642a822f2e85f079fa29a49176c49c",
              "lessThan": "6aef7cf800098749ff5d660222efaf6e01e98c09",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6f38f8c574642a822f2e85f079fa29a49176c49c",
              "lessThan": "9784e5ca91b37b387f3f414af4340c54f7a63566",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6f38f8c574642a822f2e85f079fa29a49176c49c",
              "lessThan": "12c1f6e03f944e399bd2c88441dca5dc702b95a5",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.17",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.17",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.55",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.9",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/12c1f6e03f944e399bd2c88441dca5dc702b95a5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6aef7cf800098749ff5d660222efaf6e01e98c09",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9784e5ca91b37b387f3f414af4340c54f7a63566",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}