VulnerabilityPublished 18 Oct 2026

CVE-2026-98472: Linux kernel · KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in 9784e5ca91b37b387f3f414af4340c54f7a63566 : update Linux kernel when convenient.

Data as of 27 Oct 2026, 05:11 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 9784e5ca91b37b387f3f414af4340c54f7a63566, 12c1f6e03f944e399bd2c88441dca5dc702b95a5, 6aef7cf800098749ff5d660222efaf6e01e98c09

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to 9784e5ca91b37b387f3f414af4340c54f7a63566, 12c1f6e03f944e399bd2c88441dca5dc702b95a5 or 6aef7cf800098749ff5d660222efaf6e01e98c09.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 6f38f8c574642a822f2e85f079fa29a49176c49c, < 9784e5ca91b37b387f3f414af4340c54f7a63566	Fixed in 9784e5ca91b37b387f3f414af4340c54f7a63566
LinuxLinux	Affected ≥ 6f38f8c574642a822f2e85f079fa29a49176c49c, < 12c1f6e03f944e399bd2c88441dca5dc702b95a5	Fixed in 12c1f6e03f944e399bd2c88441dca5dc702b95a5
LinuxLinux	Affected ≥ 6f38f8c574642a822f2e85f079fa29a49176c49c, < 6aef7cf800098749ff5d660222efaf6e01e98c09	Fixed in 6aef7cf800098749ff5d660222efaf6e01e98c09
LinuxLinux	Affected =6.17	Fixed in–
Debiandebian/linux`pkg:deb/debian/linux`Other threats	Affected =6.17	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix is available and has been applied in the Linux kernel. Users should update to the patched kernel versions containing the commits identified by hashes 9784e5ca91b37b387f3f414af4340c54f7a63566, 12c1f6e03f944e399bd2c88441dca5dc702b95a5, and 6aef7cf800098749ff5d660222efaf6e01e98c09. No additional mitigation steps are required beyond applying the official patch.

Description

A vulnerability in the Linux kernel's KVM SEV implementation involves improper freeing of the 'have_run_cpus' cpumask during virtual machine destruction. This mask is freed unconditionally even if the VM is no longer an SEV VM, such as after intra-host migration. The fix ensures that the mask is freed safely during VM destruction to prevent potential use-after-free conditions.

Impact

The vulnerability could lead to use-after-free conditions in the KVM SEV code path during VM destruction, potentially causing memory corruption or instability in the hypervisor. However, no known exploits are reported in the wild. The fix prevents these memory safety issues by properly freeing the cpumask in all relevant scenarios.

Summary

The Linux kernel's KVM SEV (Secure Encrypted Virtualization) feature had a flaw where the 'have_run_cpus' cpumask was not freed correctly during VM destruction if the VM transitioned from an SEV to a non-SEV state, such as after intra-host migration. This unconditional freeing of the cpumask during VM destruction addresses potential use-after-free vulnerabilities that could arise if the mask were not properly nullified or freed in other code paths. The patch improves robustness by ensuring the cpumask is freed during VM destruction regardless of the VM's SEV state, avoiding complex conditional logic and reducing the risk of memory safety issues.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 11:05 UTC

Technical details

References

Community reviews

Related threats