In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV… (CVE-2026-98472)

The vulnerability in the Linux kernel affects the KVM SEV (Secure Encrypted Virtualization) feature. Specifically, the 'have_run_cpus' cpumask, which tracks CPUs that have run the VM, is freed unconditionally during VM destruction. This is necessary because an SEV VM transitions to a non-SEV VM state upon intra-host migration, but the cpumask could otherwise remain allocated, leading to potential use-after-free (UAF) issues. The patch ensures that the cpumask is freed in the VM destroy path regardless of the VM's SEV state, improving robustness and preventing UAF vulnerabilities related to this resource management.

If unpatched, the improper freeing of the 'have_run_cpus' cpumask could lead to use-after-free conditions within the KVM SEV virtualization code. This could potentially cause kernel memory corruption or instability. However, no known exploits in the wild have been reported for this vulnerability. The impact is limited to environments using KVM with SEV-enabled VMs that undergo intra-host migration.

A fix has been implemented in the Linux kernel to unconditionally free the 'have_run_cpus' cpumask during VM destruction, addressing the vulnerability. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.