In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2… (CVE-2026-98928)

The Linux kernel's KVM arm64 implementation had a vulnerability where the GUEST_HAS_SVE flag was inconsistently derived from the host's SVE feature bit at EL2. The function pkvm_init_features_from_host() separately took the flag and the SVE feature bit, but pkvm_vcpu_init_sve() tested the bit while vcpu_has_sve() read the flag, leading to a mismatch. This could result in a vCPU with a NULL sve_state, causing the world switch to load the guest's SVE state incorrectly. The patch fixes this by deriving the GUEST_HAS_SVE flag directly from the SVE feature bit and removing dead code related to protected VMs, which are not allowed to use SVE.

The vulnerability could cause incorrect handling of the SVE state in virtual CPUs on arm64 KVM guests, potentially leading to inconsistent or invalid SVE state during context switches. This may affect the stability or correctness of virtual machines using SVE features. However, no known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to a kernel version that includes this patch to ensure correct handling of the GUEST_HAS_SVE flag and SVE state in arm64 KVM guests.