CVE-2026-98719

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it

Nullify have_run_cpus when freeing the mask, particularly in the error path

of __sev_guest_init(), so that KVM doesn't have to subtly use sev->active

to track whether or not the mask has been freed. As pointed out by Sashiko,

blindly freeing the mask in sev_vm_destroy() results in a double-free if

the mask is freed if __sev_guest_init() fails.

Throw the logic in a helper as nullifying the pointer is frustratingly

difficult and weird due to have_run_cpus being a single-entry array when

CPUMASK_OFFSTACK=n. Deliberately don't use CPUMASK_VAR_NULL, as it's not

directly assignable when the cpumask is on-stack, e.g. requires using a

local variable and a memcpy(), which is beyond ridiculous. Furthermore,

while clearing the on-stack bitmask is an unnecessary and arguably unwanted

side effect, KVM absolutely relies on '0' being the "null" value given that

the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References