CVE-2026-98472: KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Free haveruncpus during VM destruction even if VM is no longer SEV
Unconditionally free SEV's "have run CPUs" cpumask in the VM destroy path, i.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV VM if its state is intra-host migrated. Alternatively, the mask could be freed in sevmigratefrom() when "converting" the source VM, but that gets annoying because ideally KVM would nullify the mask to guard against UAF, and nullifying the mask would need be conditioned on CPUMASKOFFSTACK=y.
Freeing the mask during sevmigratefrom() is also not robust against other KVM bugs, though that's kind of a moot point since any such bugs would show up even if sev->active is never set. I.e. KVM must get that side of things correct. But, that's not a great reason to add more code just to make things marginally less robust.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The issue applies to Linux kernel KVM environments using SEV where a VM can undergo intra-host migration. An SEV VM may appear to be non-SEV after that migration, while still retaining the SEV “have run CPUs” cpumask that must be freed during destruction.
What condition triggers the vulnerable cleanup path?
The relevant condition is destruction of a VM that was originally SEV-enabled but became non-SEV as part of intra-host migration. The cleanup path must free the SEV cpumask even when the VM no longer appears to be SEV.
How can I determine whether my kernel includes the fix?
Check whether the kernel incorporates one of the referenced stable commits: 6aef7cf800098749ff5d660222efaf6e01e98c09, 9784e5ca91b37b387f3f414af4340c54f7a63566, or 12c1f6e03f944e399bd2c88441dca5dc702b95a5. The provided data does not identify affected or fixed kernel version numbers.