Answer in brief
CVE-2026-98719 records a Unknown severity vulnerability in KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=6aef7cf800098749ff5d660222efaf6e01e98c09 <b1de3ebf59507e0edacaa5cfa2225bc1869e1b63 || >=9784e5ca91b37b387f3f414af4340c54f7a63566 <0fbc7fec2242de6c3dcea6de55573c428e820173 || >=12c1f6e03f944e399bd2c88441dca5dc702b95a5 <8abbc76120a74bfba1851bd97528099d715e45c6 || >=6.18.55 <6.18.56 || >=7.2.9 <7.2.10 | b1de3ebf59507e0edacaa5cfa2225bc1869e1b63, 0fbc7fec2242de6c3dcea6de55573c428e820173, 8abbc76120a74bfba1851bd97528099d715e45c6, 6.18.56, 7.2.10 |
| Linux/Linuxgeneric | 7.3-rc5 | Not reported |
| Linux/Linuxgeneric | >=6aef7cf800098749ff5d660222efaf6e01e98c09 <b1de3ebf59507e0edacaa5cfa2225bc1869e1b63 || >=9784e5ca91b37b387f3f414af4340c54f7a63566 <0fbc7fec2242de6c3dcea6de55573c428e820173 || >=12c1f6e03f944e399bd2c88441dca5dc702b95a5 <8abbc76120a74bfba1851bd97528099d715e45c6 | b1de3ebf59507e0edacaa5cfa2225bc1869e1b63, 0fbc7fec2242de6c3dcea6de55573c428e820173, 8abbc76120a74bfba1851bd97528099d715e45c6 |
| Linux/Linuxgeneric | >=6.18.55 <6.18.56 || >=7.2.9 <7.2.10 | 6.18.56, 7.2.10 |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it Nullify have_run_cpus when freeing the mask, particularly in the error path of __sev_guest_init(), so that KVM doesn't have to subtly use sev->active to track whether or not the mask has been freed. As pointed out by Sashiko, blindly freeing the mask in sev_vm_destroy() results in a double-free if the mask is freed if __sev_guest_init() fails. Throw the logic in a helper as nullifying the pointer is frustratingly difficult and weird due to have_run_cpus being a single-entry array when CPUMASK_OFFSTACK=n. Deliberately don't use CPUMASK_VAR_NULL, as it's not directly assignable when the cpumask is on-stack, e.g. requires using a local variable and a memcpy(), which is beyond ridiculous. Furthermore, while clearing the on-stack bitmask is an unnecessary and arguably unwanted side effect, KVM absolutely relies on '0' being the "null" value given that the struct is zero-allocated. Opportunistically add an alloc() helper to pair with free(); there are just enough call sites to make doing so worthwhile.
Quoted source text, attributed separately from HOL analysis.