Riskcovery

CVE-2026-98714

KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded

State
Published
Severity
Not scored
Published
Oct 18, 2026
Updated
Oct 26, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded

Leave control.erap_ctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD:

there's no explicit architectural guarantee about the behavior in the presence of VMRUN failures. So the best thing to do would be to assume that if VMRUN fails, the actions requested in the control fields may not have been performed.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 8d28fec406e4d5ce6c109fe12699976e72e9748e to before 8676b29d186fcb5c1251d8152fc91d19421e5600Affected
  • 8d28fec406e4d5ce6c109fe12699976e72e9748e to before e27fc915c8f575ab5630e27d97465c2077d4b9d1Affected
LinuxLinux
  • 2.6.38Affected
  • before 2.6.38Not affected
  • 7.2.10 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.