In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM during intra-host migration… (CVE-2026-98471)

The vulnerability in the Linux kernel's KVM SEV feature concerned improper cache maintenance during intra-host migration of virtual machines. When a source VM is converted from an SEV-enabled VM to a non-SEV VM, KVM's memory reclaim mechanisms do not trigger cache maintenance, potentially leaving stale data in CPU caches after the VM is destroyed. The destination VM cannot be relied upon to perform cache maintenance due to possible differences in guest memory configurations. The resolution involves manually performing cache maintenance on the source VM during migration to ensure no stale data remains in CPU caches.

If unmitigated, stale data could remain in CPU caches after the source VM is destroyed during intra-host migration, potentially leading to data leakage or exposure of sensitive information from the source VM. However, the exact impact depends on the ability of an attacker to access this stale cache data, which is not detailed in the provided information.

A fix has been implemented in the Linux kernel to manually perform cache maintenance on the source VM during intra-host migration. Users should apply the updated Linux kernel version containing this fix. No alternative mitigations are indicated or required according to the provided data.