CVE-2026-98718

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98718", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.366Z", "datePublished": "2026-10-18T15:46:53.611Z", "dateUpdated": "2026-10-19T09:24:29.156Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:24:29.156Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state\n\nExplicitly flush caches after intra-host migration before clearing \"SEV\nactive\" on the source VM, as doing cache maintenance afterwards creates a\ntiny window where memory reclaim could return memory to the host without\nperforming a cache flush, e.g. as pointed out by Sashiko:\n\n CPU1 in sev_migrate_from():\n src->active = false;\n\n CPU2 running concurrent unmap:\n Since active is false, the automatic cache flush in\n sev_guest_memory_reclaimed is skipped.\n The host frees and reallocates the page.\n\n CPU1 in sev_migrate_from():\n sev_writeback_caches(src_kvm);\n Executes a hardware cache flush (wbnoinvd), which writes the guest's old\n dirty ciphertext over the new page owner's data."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/sev.c"], "versions": [{"version": "37dfb676fafd1eef36fe0bb649607afbb0d5521b", "lessThan": "8b7d4f68fef96cebe0b6dbb6e5607772337f7369", "status": "affected", "versionType": "git"}, {"version": "d4cc2dff12116a700add601c0262132cc26e1b2c", "lessThan": "de83ff6a4d8f3618473bedb3c4400020c22e8a8a", "status": "affected", "versionType": "git"}, {"version": "93de2a6a4b91b72607136dd656edf03fb399d27f", "lessThan": "973ea70393e885e540f714904e51bc6cac80e3d7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/sev.c"], "versions": [{"version": "6.18.55", "lessThan": "6.18.56", "status": "affected", "versionType": "semver"}, {"version": "7.2.9", "lessThan": "7.2.10", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.55", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2.9", "versionEndExcluding": "7.2.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8b7d4f68fef96cebe0b6dbb6e5607772337f7369"}, {"url": "https://git.kernel.org/stable/c/de83ff6a4d8f3618473bedb3c4400020c22e8a8a"}, {"url": "https://git.kernel.org/stable/c/973ea70393e885e540f714904e51bc6cac80e3d7"}], "title": "KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/kvm/svm/sev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8b7d4f68fef96cebe0b6dbb6e5607772337f7369", "status": "affected", "version": "37dfb676fafd1eef36fe0bb649607afbb0d5521b", "versionType": "git"}, {"lessThan": "de83ff6a4d8f3618473bedb3c4400020c22e8a8a", "status": "affected", "version": "d4cc2dff12116a700add601c0262132cc26e1b2c", "versionType": "git"}, {"lessThan": "973ea70393e885e540f714904e51bc6cac80e3d7", "status": "affected", "version": "93de2a6a4b91b72607136dd656edf03fb399d27f", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/kvm/svm/sev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.18.56", "status": "affected", "version": "6.18.55", "versionType": "semver"}, {"lessThan": "7.2.10", "status": "affected", "version": "7.2.9", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state\n\nExplicitly flush caches after intra-host migration before clearing \"SEV\nactive\" on the source VM, as doing cache maintenance afterwards creates a\ntiny window where memory reclaim could return memory to the host without\nperforming a cache flush, e.g. as pointed out by Sashiko:\n\n CPU1 in sev_migrate_from():\n src->active = false;\n\n CPU2 running concurrent unmap:\n Since active is false, the automatic cache flush in\n sev_guest_memory_reclaimed is skipped.\n The host frees and reallocates the page.\n\n CPU1 in sev_migrate_from():\n sev_writeback_caches(src_kvm);\n Executes a hardware cache flush (wbnoinvd), which writes the guest's old\n dirty ciphertext over the new page owner's data."}], "id": "CVE-2026-98718", "lastModified": "2026-10-19T10:19:36.047", "metrics": {}, "published": "2026-10-18T16:17:25.363", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8b7d4f68fef96cebe0b6dbb6e5607772337f7369"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/973ea70393e885e540f714904e51bc6cac80e3d7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/de83ff6a4d8f3618473bedb3c4400020c22e8a8a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state", "id": "2555118", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555118"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-366", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state\nExplicitly flush caches after intra-host migration before clearing \"SEV\nactive\" on the source VM, as doing cache maintenance afterwards creates a\ntiny window where memory reclaim could return memory to the host without\nperforming a cache flush, e.g. as pointed out by Sashiko:\nCPU1 in sev_migrate_from():\nsrc->active = false;\nCPU2 running concurrent unmap:\nSince active is false, the automatic cache flush in\nsev_guest_memory_reclaimed is skipped.\nThe host frees and reallocates the page.\nCPU1 in sev_migrate_from():\nsev_writeback_caches(src_kvm);\nExecutes a hardware cache flush (wbnoinvd), which writes the guest's old\ndirty ciphertext over the new page owner's data.", "A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem supporting AMD SEV (Secure Encrypted Virtualization). During virtual machine migration on the same host, CPU cache maintenance was performed after deactivating the source guest's encryption state instead of before. This timing window allows concurrent host memory reclaim operations to reallocate guest memory pages before caches are flushed. As a result, subsequent delayed cache writebacks can overwrite newly allocated memory with stale guest data, leading to memory corruption and host system instability."], "name": "CVE-2026-98718", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98718\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98718\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98718.mbox"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37dfb676fafd1eef36fe0bb649607afbb0d5521b,8b7d4f68fef96cebe0b6dbb6e5607772337f7369)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4cc2dff12116a700add601c0262132cc26e1b2c,de83ff6a4d8f3618473bedb3c4400020c22e8a8a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[93de2a6a4b91b72607136dd656edf03fb399d27f,973ea70393e885e540f714904e51bc6cac80e3d7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.55,6.18.56)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.2.9,7.2.10)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T19:30:14.461684+00:00", "updated": "2026-10-23T07:45:17.027194+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}