CVE-2026-98719 Linux CVE debrief

Who should care

Defenders responsible for KVM: SEV deployments, particularly those using Linux kernel versions potentially affected by this vulnerability, should assess exposure and prioritize verification.

Why it matters

A vulnerability in the Linux kernel affects KVM: SEV, requiring defenders to assess exposure and prioritize verification of deployments.

• Verification of KVM: SEV deployments for potential vulnerability
• Assessment of Linux kernel versions for exposure
• Implementation of nullifying 'have run CPUs' mask pointer when freeing

Technical summary

The Linux kernel vulnerability affects KVM: SEV, specifically in the handling of the 'have run CPUs' mask pointer. A double-free error occurs if the mask is freed in the error path of __sev_guest_init(). The issue is addressed by introducing a helper to nullify the pointer. This vulnerability requires defenders to assess exposure and prioritize verification of KVM: SEV deployments, focusing on Linux kernel versions that may be affected by this vulnerability. The nullification of the 'have run CPUs' mask pointer prevents a double-free error, ensuring the stability and security of KVM: SEV deployments.

Defensive priority

Defenders should assess exposure and prioritize verification of KVM: SEV deployments, focusing on Linux kernel versions that may be affected by this vulnerability.

Recommended defensive actions

• Assess exposure of KVM: SEV deployments
• Verify Linux kernel versions for potential vulnerability
• Implement nullifying 'have run CPUs' mask pointer when freeing
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source metadata indicate a vulnerability in the Linux kernel related to KVM: SEV. The issue involves a double-free error in the 'have run CPUs' mask pointer. Official sources, including the CVE Program and NVD, provide relevant information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.