In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM before clearing SEV state… (CVE-2026-98718)

The vulnerability in the Linux kernel's KVM SEV (Secure Encrypted Virtualization) feature involved improper ordering of cache maintenance operations during intra-host VM migration. Specifically, the source VM's caches were not flushed before clearing the SEV active state, creating a race condition where memory could be reclaimed by the host without a cache flush. This could lead to the host freeing and reallocating pages while stale encrypted data remained in the cache, risking data integrity or confidentiality. The fix enforces explicit cache flushes before clearing the SEV active flag, closing this timing window.

The vulnerability could allow memory pages to be reclaimed and reused by the host without proper cache flushing, potentially exposing stale or sensitive encrypted data from the source VM. This impacts the confidentiality and integrity of memory contents during VM migration under SEV. However, no known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to the patched kernel version that includes this fix. Since this is a kernel-level issue, applying the official kernel update is the recommended remediation.