KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98719
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-18 16:17:25 UTC
Updated2026-10-19 10:19:36 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it Nullify have_run_cpus when freeing the mask, particularly in the error path of __sev_guest_init(), so that KVM doesn't have to subtly use sev->active to track whether or not the mask has been freed. As pointed out by Sashiko, blindly freeing the mask in sev_vm_destroy() results in a double-free if the mask is freed if __sev_guest_init() fails. Throw the logic in a helper as nullifying the pointer is frustratingly difficult and weird due to have_run_cpus being a single-entry array when CPUMASK_OFFSTACK=n. Deliberately don't use CPUMASK_VAR_NULL, as it's not directly assignable when the cpumask is on-stack, e.g. requires using a local variable and a memcpy(), which is beyond ridiculous. Furthermore, while clearing the on-stack bitmask is an unnecessary and arguably unwanted side effect, KVM absolutely relies on '0' being the "null" value given that the struct is zero-allocated. Opportunistically add an alloc() helper to pair with free(); there are just enough call sites to make doing so worthwhile.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 6aef7cf800098749ff5d660222efaf6e01e98c09 b1de3ebf59507e0edacaa5cfa2225bc1869e1b63 git Not specified
CNA Linux Linux affected 9784e5ca91b37b387f3f414af4340c54f7a63566 0fbc7fec2242de6c3dcea6de55573c428e820173 git Not specified
CNA Linux Linux affected 12c1f6e03f944e399bd2c88441dca5dc702b95a5 8abbc76120a74bfba1851bd97528099d715e45c6 git Not specified
CNA Linux Linux affected 6.18.55 6.18.56 semver Not specified
CNA Linux Linux affected 7.2.9 7.2.10 semver Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/0fbc7fec2242de6c3dcea6de55573c428e820173 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/8abbc76120a74bfba1851bd97528099d715e45c6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b1de3ebf59507e0edacaa5cfa2225bc1869e1b63 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report