CVE-2026-98714

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98714", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.366Z", "datePublished": "2026-10-18T15:46:47.176Z", "dateUpdated": "2026-11-10T18:15:18.111Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-10T18:15:18.111Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded\n\nLeave control.erap_ctl and control.clean as-is in the VMCS if VMRUN fails,\nbecause as per AMD:\n\n there's no explicit architectural guarantee about the behavior in the\n presence of VMRUN failures. So the best thing to do would be to assume\n that if VMRUN fails, the actions requested in the control fields may not\n have been performed."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/svm.c"], "versions": [{"version": "8d28fec406e4d5ce6c109fe12699976e72e9748e", "lessThan": "2e9b8c79ae6c1dcf650ea288cf8fc69ee5241dd9", "status": "affected", "versionType": "git"}, {"version": "8d28fec406e4d5ce6c109fe12699976e72e9748e", "lessThan": "5d06e2f861d61a03481348378fdf9cc3e68bff47", "status": "affected", "versionType": "git"}, {"version": "8d28fec406e4d5ce6c109fe12699976e72e9748e", "lessThan": "8676b29d186fcb5c1251d8152fc91d19421e5600", "status": "affected", "versionType": "git"}, {"version": "8d28fec406e4d5ce6c109fe12699976e72e9748e", "lessThan": "e27fc915c8f575ab5630e27d97465c2077d4b9d1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/svm.c"], "versions": [{"version": "2.6.38", "status": "affected"}, {"version": "0", "lessThan": "2.6.38", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.117", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.61", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.12.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.18.61"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2e9b8c79ae6c1dcf650ea288cf8fc69ee5241dd9"}, {"url": "https://git.kernel.org/stable/c/5d06e2f861d61a03481348378fdf9cc3e68bff47"}, {"url": "https://git.kernel.org/stable/c/8676b29d186fcb5c1251d8152fc91d19421e5600"}, {"url": "https://git.kernel.org/stable/c/e27fc915c8f575ab5630e27d97465c2077d4b9d1"}], "title": "KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/kvm/svm/svm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2e9b8c79ae6c1dcf650ea288cf8fc69ee5241dd9", "status": "affected", "version": "8d28fec406e4d5ce6c109fe12699976e72e9748e", "versionType": "git"}, {"lessThan": "5d06e2f861d61a03481348378fdf9cc3e68bff47", "status": "affected", "version": "8d28fec406e4d5ce6c109fe12699976e72e9748e", "versionType": "git"}, {"lessThan": "8676b29d186fcb5c1251d8152fc91d19421e5600", "status": "affected", "version": "8d28fec406e4d5ce6c109fe12699976e72e9748e", "versionType": "git"}, {"lessThan": "e27fc915c8f575ab5630e27d97465c2077d4b9d1", "status": "affected", "version": "8d28fec406e4d5ce6c109fe12699976e72e9748e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/kvm/svm/svm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.38"}, {"lessThan": "2.6.38", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.117", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.61", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded\n\nLeave control.erap_ctl and control.clean as-is in the VMCS if VMRUN fails,\nbecause as per AMD:\n\n there's no explicit architectural guarantee about the behavior in the\n presence of VMRUN failures. So the best thing to do would be to assume\n that if VMRUN fails, the actions requested in the control fields may not\n have been performed."}], "id": "CVE-2026-98714", "lastModified": "2026-11-10T19:22:26.340", "metrics": {}, "published": "2026-10-18T16:17:24.953", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e9b8c79ae6c1dcf650ea288cf8fc69ee5241dd9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5d06e2f861d61a03481348378fdf9cc3e68bff47"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8676b29d186fcb5c1251d8152fc91d19421e5600"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e27fc915c8f575ab5630e27d97465c2077d4b9d1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded", "id": "2555189", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555189"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-252", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded\nLeave control.erap_ctl and control.clean as-is in the VMCS if VMRUN fails,\nbecause as per AMD:\nthere's no explicit architectural guarantee about the behavior in the\npresence of VMRUN failures. So the best thing to do would be to assume\nthat if VMRUN fails, the actions requested in the control fields may not\nhave been performed.", "A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for AMD processors (SVM). When virtual machine execution fails, the hypervisor prematurely updates control fields and marks control blocks as clean, assuming hardware operations were performed. A local attacker could leverage this behavior to cause state desynchronization between KVM and the processor, leading to system instability or unexpected guest behavior."], "name": "CVE-2026-98714", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98714\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98714\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98714.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8676b29d186fcb5c1251d8152fc91d19421e5600)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e27fc915c8f575ab5630e27d97465c2077d4b9d1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.10)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T22:15:14.437984+00:00", "updated": "2026-10-23T09:00:15.770097+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}