KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it Nullify have_run_cpus when freeing the mask, particularly in the error path of __sev_guest_init(), so that KVM doesn't have to subtly use sev->active to track whether or not the mask has been freed. As pointed out by Sashiko, blindly freeing the mask in sev_vm_destroy() results in a double-free if the mask is freed if __sev_guest_init() fails. Throw the logic in a helper as nullifying the pointer is frustratingly difficult and weird due to have_run_cpus being a single-entry array when CPUMASK_OFFSTACK=n. Deliberately don't use CPUMASK_VAR_NULL, as it's not directly assignable when the cpumask is on-stack, e.g. requires using a local variable and a memcpy(), which is beyond ridiculous. Furthermore, while clearing the on-stack bitmask is an unnecessary and arguably unwanted side effect, KVM absolutely relies on '0' being the "null" value given that the struct is zero-allocated. Opportunistically add an alloc() helper to pair with free(); there are just enough call sites to make doing so worthwhile.
CVE-2026-98719
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98719
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6aef7cf800098749ff5d660222efaf6e01e98c09",
"lessThan": "b1de3ebf59507e0edacaa5cfa2225bc1869e1b63",
"versionType": "git"
},
{
"status": "affected",
"version": "9784e5ca91b37b387f3f414af4340c54f7a63566",
"lessThan": "0fbc7fec2242de6c3dcea6de55573c428e820173",
"versionType": "git"
},
{
"status": "affected",
"version": "12c1f6e03f944e399bd2c88441dca5dc702b95a5",
"lessThan": "8abbc76120a74bfba1851bd97528099d715e45c6",
"versionType": "git"
}
],
"programFiles": [
"arch/x86/kvm/svm/sev.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18.55",
"lessThan": "6.18.56",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.2.9",
"lessThan": "7.2.10",
"versionType": "semver"
}
],
"programFiles": [
"arch/x86/kvm/svm/sev.c"
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-98719
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38700 · Revision 1
- Added to Heist Feed
- Publisher date