In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded Leave… (CVE-2026-98714)

The vulnerability in the Linux kernel's KVM SVM (Secure Virtual Machine) implementation involved improper updating of control fields on VMEXIT regardless of whether the VMRUN instruction succeeded. According to AMD, there is no architectural guarantee about behavior when VMRUN fails, so control fields such as erap_ctl and control.clean should remain unchanged if VMRUN fails. The patch corrects this by updating control fields only when VMRUN succeeds, preventing potential inconsistencies in VM state management.

If VMRUN fails but control fields are updated, the virtual machine's control state could become inconsistent, potentially leading to undefined behavior in virtualization. This could affect the stability or security of virtual machines running on affected Linux kernels. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to update control fields on VMEXIT only if VMRUN succeeds. Users should apply the official kernel updates that include this fix. No additional mitigation is required beyond applying the patch.