CVE-2026-98472

Status: ReceivedUnscored—

Severity—Unscored

Exploitation probability0.17 %higher than 5% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV

Unconditionally free SEV's "have run CPUs" cpumask in the VM destroy path, i.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV VM if its state is intra-host migrated. Alternatively, the mask could be freed in sev_migrate_from() when "converting" the source VM, but that gets annoying because ideally KVM would nullify the mask to guard against UAF, and nullifying the mask would need be conditioned on CPUMASK_OFFSTACK=y.

Freeing the mask during sev_migrate_from() is also not robust against other KVM bugs, though that's kind of a moot point since any such bugs would show up even if sev->active is never set. I.e.

Read full descriptionShow less

KVM must get that side of things correct. But, that's not a great reason to add more code just to make things marginally less robust.

CVSS

NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.17 %
Percentile among all scored CVEs: 5
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Linux — Linux Kernel^AI

References

Show 3 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-98472",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6f38f8c574642a822f2e85f079fa29a49176c49c",
              "lessThan": "6aef7cf800098749ff5d660222efaf6e01e98c09",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6f38f8c574642a822f2e85f079fa29a49176c49c",
              "lessThan": "9784e5ca91b37b387f3f414af4340c54f7a63566",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6f38f8c574642a822f2e85f079fa29a49176c49c",
              "lessThan": "12c1f6e03f944e399bd2c88441dca5dc702b95a5",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-18T16:16:57.697",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/12c1f6e03f944e399bd2c88441dca5dc702b95a5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6aef7cf800098749ff5d660222efaf6e01e98c09",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9784e5ca91b37b387f3f414af4340c54f7a63566",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV\n\nUnconditionally free SEV's \"have run CPUs\" cpumask in the VM destroy path,\ni.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV\nVM if its state is intra-host migrated.  Alternatively, the mask could be\nfreed in sev_migrate_from() when \"converting\" the source VM, but that gets\nannoying because ideally KVM would nullify the mask to guard against UAF,\nand nullifying the mask would need be conditioned on CPUMASK_OFFSTACK=y.\n\nFreeing the mask during sev_migrate_from() is also not robust against other\nKVM bugs, though that's kind of a moot point since any such bugs would show\nup even if sev->active is never set.  I.e. KVM must get that side of things\ncorrect.  But, that's not a great reason to add more code just to make\nthings marginally less robust."
    }
  ],
  "lastModified": "2026-10-19T10:18:57.743",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}