UBUNTU-CVE-2026-98928: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUESTHASSVE from the SVE feature bit at EL2 pkvminitfeaturesfromhost() takes KVMARCHFLAGGUESTHASSVE and KVMARMVCPUSVE from the host separately, but pkvmvcpuinitsve() tests the bit while vcpuhassve() reads the flag. A host that sets the flag without the bit gets a vCPU with a NULL svestate that the world switch loads the guest's SVE state from. Derive the flag from the bit, and drop the protected path's copy of the host's flag, which is dead code since protected VMs are not allowed SVE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Derive GUEST_HAS_SVE from the SVE feature bit at EL2 instead of separately copying KVM_ARCH_FLAG_GUEST_HAS_SVE from the host, and drop the protected path's copy of the host flag because protected VMs are not allowed SVE.
Linux kernel KVM arm64 protected VMs GUEST_HAS_SVE = derived from the SVE feature bit at EL2
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue concerns arm64 KVM hosts where the host exposes KVM_ARCH_FLAG_GUEST_HAS_SVE without the corresponding SVE feature bit at EL2. This mismatch can create a vCPU with a NULL SVE state that is later used during a world switch.
Are protected VMs affected?
Protected VMs are not allowed to use SVE. The protected path's separate copy of the host SVE flag is described as dead code for that reason.
How can I determine whether the vulnerable condition exists?
Check whether the host configuration presents the guest-SVE architectural flag while the SVE feature bit is absent at EL2. The vulnerable condition is specifically this disagreement between the flag and feature bit.