CVE-2026-98715

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN

Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN,

as empirical testing shows that the CPU performs the requested TLB flush if

and only if VMRUN is successful, i.e. clearing TLB control on a failed

VMRUN effectively drops a TLB flush.

Explicitly track the need to flush all ASIDs on a per-CPU basis, as the

ASID reuse condition is tied to the pCPU, not to the vCPU. As a bonus,

this also obviates the need to avoid clobbering FLUSH_ALL_ASID with

TLB_CONTROL_FLUSH_ASID, e.g. in svm_flush_tlb_asid().

Deliberately don't bother saving/restoring the "old" tlb_ctl on failure,

in quotes because it's not exactly the old tlb_ctl, it's the tlb_ctl from

after pre_svm_run(), but before updating tlb_ctl for flush_all_asids. If

VMRUN fails and TLB_CONTROL_FLUSH_ALL_ASID is forced, then the next

successful run of the VMCB *may* unnecessa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References