CVE-2026-98472: Linux Kernel KVM SEV Use-After-Free Flaw

CVE-2026-98472 Overview

CVE-2026-98472 affects the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem, specifically the AMD Secure Encrypted Virtualization (SEV) implementation. The vulnerability stems from improper memory management of the have_run_cpus cpumask during virtual machine (VM) destruction. When an SEV VM undergoes intra-host migration, it converts to a non-SEV VM. The destroy path previously skipped freeing the cpumask for non-SEV VMs, leaving allocated memory unreleased. Maintainers resolved the issue by unconditionally freeing the mask during VM teardown regardless of the current SEV state.

Critical Impact
Memory handling flaw in the KVM SEV destroy path can lead to resource leaks or use-after-free conditions on hosts running AMD SEV workloads with intra-host migration.

Affected Products

Linux kernel KVM subsystem (AMD SEV code path)
Hypervisor hosts running SEV-enabled virtual machines
Systems using KVM intra-host VM migration with SEV

Discovery Timeline

2026-10-18 - CVE-2026-98472 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98472

Vulnerability Analysis

The flaw resides in the KVM SEV destruction logic within the Linux kernel. SEV VMs allocate a have_run_cpus cpumask to track which physical CPUs have executed the guest. The original VM destroy path only freed this cpumask when sev->active was true. However, KVM supports intra-host migration via sev_migrate_from(), which transfers SEV state from a source VM to a destination. After migration, the source VM is no longer considered an SEV VM, yet its allocated cpumask remains in place.

When such a converted VM reaches the destroy path, the conditional free was skipped and the previously allocated memory was not released. This creates either a memory leak or a potential use-after-free depending on kernel configuration and subsequent access patterns.

Root Cause

The root cause is a mismatched lifecycle assumption between allocation and deallocation. The cpumask is allocated when a VM becomes SEV-active, but the free path checked the current sev->active flag rather than tracking whether allocation ever occurred. Intra-host migration clears the active state on the source VM, bypassing the free logic.

Attack Vector

Exploitation requires local privileges on a KVM host capable of creating SEV VMs and invoking intra-host migration. There are no public exploits for CVE-2026-98472 and no evidence of in-the-wild exploitation. The attack surface is limited to hypervisor hosts running AMD SEV workloads with migration enabled.

The vulnerability is fixed by unconditionally freeing the cpumask in the destroy path. See the upstream commits in the Linux Kernel Commit Update, Linux Kernel Commit Change, and Linux Kernel Commit Modification for technical details of the patch.

Detection Methods for CVE-2026-98472

Indicators of Compromise

Unexpected kernel memory growth on KVM hosts running SEV guests with repeated intra-host migrations
Kernel oops or panic traces referencing sev_vm_destroy or cpumask operations
KASAN reports flagging use-after-free in KVM SEV destroy paths on debug kernels

Detection Strategies

Audit running kernel versions against the fixed upstream commits listed in the vendor references
Enable kernel memory sanitizers (KASAN, KFENCE) in test environments running SEV workloads
Review hypervisor logs for abnormal VM destroy sequences following KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM operations

Monitoring Recommendations

Track kernel version inventory across virtualization hosts and alert on unpatched systems
Monitor /proc/slabinfo and /proc/meminfo for sustained growth tied to KVM allocations
Correlate guest migration events with host-side kernel error messages

How to Mitigate CVE-2026-98472

Immediate Actions Required

Apply stable kernel updates containing the three referenced upstream commits
Prioritize patching on hosts that use AMD SEV with intra-host migration workflows
Validate kernel package versions on all KVM hypervisors in your fleet

Patch Information

Fixes were merged into the Linux kernel stable trees. The relevant commits are 12c1f6e03f944e399bd2c88441dca5dc702b95a5, 6aef7cf800098749ff5d660222efaf6e01e98c09, and 9784e5ca91b37b387f3f414af4340c54f7a63566. Apply the vendor kernel update appropriate to your distribution.

Workarounds

Disable intra-host SEV migration (KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM) in orchestration workflows until the kernel is patched
Restrict access to /dev/kvm and SEV ioctls to trusted system components only
Reboot hypervisor hosts periodically to reclaim leaked kernel memory on unpatched systems

bash

# Verify running kernel version and check for the fix
uname -r

# Debian/Ubuntu: install the latest kernel
sudo apt update && sudo apt install --only-upgrade linux-image-generic

# RHEL/Fedora/CentOS Stream: update the kernel package
sudo dnf update kernel

# Reboot to activate the patched kernel
sudo systemctl reboot