In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it Nullify… (CVE-2026-98719)

The vulnerability in the Linux kernel's KVM SEV subsystem arises from improper management of the 'have run CPUs' mask pointer during error handling in __sev_guest_init(). Specifically, the mask pointer was not nullified when freed, leading to a potential double-free in sev_vm_destroy() if __sev_guest_init() fails. The fix involves nullifying the pointer in a helper function to avoid double-free issues, taking into account the complexity of the mask being a single-entry array when CPUMASK_OFFSTACK=n. Additionally, an allocation helper was added to complement the free operation. This correction ensures that KVM does not rely on subtle tracking of the mask's state and prevents unsafe memory operations.

The vulnerability could lead to a double-free condition in the Linux kernel's KVM SEV code path, which may cause kernel instability or crashes. There is no indication of known exploitation in the wild or direct impact beyond potential memory corruption or denial of service due to double-free.

A fix has been implemented in the Linux kernel to nullify the 'have run CPUs' mask pointer when freeing it, preventing double-free errors. Users should update to the fixed kernel version once it is released. Patch status is not yet confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and remediation guidance.