{"id":40944,"date":"2026-10-19T00:31:38","date_gmt":"2026-10-18T16:31:38","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98472"},"modified":"2026-10-19T00:31:38","modified_gmt":"2026-10-18T16:31:38","slug":"cve-2026-98472","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98472","title":{"rendered":"CVE-2026-98472 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Free have_r"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV<\/p>\n<p>Unconditionally free SEV&#8217;s &#8220;have run CPUs&#8221; cpumask in the VM destroy path,<br \/>\ni.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV<br \/>\nVM if its state is intra-host migrated.  Alternatively, the mask could be<br \/>\nfreed in sev_migrate_from() when &#8220;converting&#8221; the source VM, but that gets<br \/>\nannoying because ideally KVM would nullify the mask to guard against UAF,<br \/>\nand nullifying the mask would need be conditioned on CPUMASK_OFFSTACK=y.<\/p>\n<p>Freeing the mask during sev_migrate_from() is also not robust against other<br \/>\nKVM bugs, though that&#8217;s kind of a moot point since any such bugs would show<br \/>\nup even if sev-&gt;active is never set.  I.e. KVM must get that side of things<br \/>\ncorrect.  But, that&#8217;s not a great reason to add more code just to make<br \/>\nthings marginally less robust.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV<\/p>\n<p>Unconditionally free SEV&#8217;s &#8220;have run CPUs&#8221; cpumask <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40944","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40944","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40944"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40944"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40944"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}