All vulnerabilities
CVE-2026-98637

Linux: KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure

pkvm_vcpu_init_sve() clears KVM_ARM_VCPU_SVE in kvm->arch.vcpu_features when it fails, but vcpu_has_sve() tests KVM_ARCH_FLAG_GUEST_HAS_SVE, which is left set. Later vCPUs on that VM then skip the SVE setup and register with a NULL sve_state, which the guest's first FP access hands to sve_load_state().

Return the error without touching vcpu_features.

Text from CVE List

Affected versions 8

  • Linuxaffected: 5db1bef933427aa467ad89c7b695a84a6b4afe16 before bd46b41f412fb81c50bac1a0929ec31320f3a807CVE List
  • Linuxaffected: 5db1bef933427aa467ad89c7b695a84a6b4afe16 before f0cd8ffae092cc1b9d7cfa9188ed5a88a374adcbCVE List
  • Linuxaffected: 5db1bef933427aa467ad89c7b695a84a6b4afe16 before a1b3c788ad31837e348075e93dbba3f447492776CVE List
  • Linuxaffected: 6.16CVE List
  • Linuxunaffected: all versions before 6.16CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3