CVE-2026-98637: KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure
pkvmvcpuinitsve() clears KVMARMVCPUSVE in kvm->arch.vcpufeatures when it fails, but vcpuhassve() tests KVMARCHFLAGGUESTHASSVE, which is left set. Later vCPUs on that VM then skip the SVE setup and register with a NULL svestate, which the guest's first FP access hands to sveloadstate().
Return the error without touching vcpufeatures.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel KVM on arm64 where SVE is enabled for a VM and a vCPU SVE initialization failure occurs. The failure can leave later vCPUs registered without SVE state even though the VM is still marked as having SVE.
What event triggers the vulnerable state?
A failure in pkvm_vcpu_init_sve() triggers it. The failure clears the VM-wide vCPU SVE feature while leaving the guest-has-SVE flag set, causing subsequent vCPUs to skip SVE setup.
What is the resulting failure condition?
Later vCPUs can have a NULL sve_state. When the guest first accesses floating-point state, sve_load_state() is given that NULL state.
What should be done if the affected kernel cannot be updated immediately?
The provided data does not specify a workaround. The resolved behavior is to return the vCPU SVE initialization error without modifying the VM-wide vcpu_features state.