UBUNTU-CVE-2026-98718: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM before clearing SEV state Explicitly flush caches after intra-host migration before clearing "SEV active" on the source VM, as doing cache maintenance afterwards creates a tiny window where memory reclaim could return memory to the host without performing a cache flush, e.g. as pointed out by Sashiko: CPU1 in sevmigratefrom(): src->active = false; CPU2 running concurrent unmap: Since active is false, the automatic cache flush in sevguestmemoryreclaimed is skipped. The host frees and reallocates the page. CPU1 in sevmigratefrom(): sevwritebackcaches(srckvm); Executes a hardware cache flush (wbnoinvd), which writes the guest's old dirty ciphertext over the new page owner's data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1~24.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-43.43 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1020.21 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1017.19 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Compensating control
During intra-host SEV migration, explicitly flush caches on the source VM before clearing the source VM's SEV active state; do not clear SEV active until cache maintenance is complete.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using affected Ubuntu kernel packages and performing intra-host migration of SEV-enabled KVM virtual machines are exposed. The affected package list includes linux-riscv, linux-hwe-edge, linux-azure, linux-gcp, linux-realtime, linux-aws-5.0, linux-aws-5.3, and linux-azure-5.3.
What conditions are required for exploitation?
An intra-host migration of an SEV guest must coincide with concurrent memory unmapping and reclamation on the source VM. The race occurs when the source VM's SEV-active state is cleared before its cache maintenance completes.
What is the potential impact of the race?
A reclaimed guest page can be returned to the host and reallocated before the hardware cache flush runs. The later flush may then write the guest's old dirty ciphertext over data belonging to the page's new owner.
What can be done if an updated kernel cannot be deployed immediately?
The provided information identifies intra-host migration of SEV-enabled KVM guests as the relevant trigger condition. Avoiding that migration scenario reduces exposure until the cache-maintenance ordering fix is available.