{"id":"CVE-2026-98471","kind":"vulnerability","aliases":["CVE-2026-98471"],"related":[],"title":"Linux kernel KVM SEV: stale guest data may remain in CPU caches","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Do cache maintenance on the source VM during intra-host migration\n\nManually perform cache maintenance on the source VM during intra-host\nmigration to ensure no stale data is left in CPU caches after the VM is\ndestroyed.  Because the source VM is \"converted\" to a non-SEV VM, KVM's\nmemory reclaim flows won't trigger cache maintenance, e.g. when all guest\nmemory is reclaimed in response to detaching from the mmu_notifier.\n\nNote, relying on the destination VM to do cache maintenance isn't an option\nas KVM doesn't require identical guest memory configurations, i.e. the\nsource VM may have access to memory that the destination VM does not.\nEnforcing equivalent memory configurations is infeasible, as it would\nrequire a *deep* comparison of memslots, e.g. to verify that not only are\nthe memslot identical, but what the memslots point at is also identical.","summary":"During intra-host migration of an SEV guest, the kernel's KVM code did not flush CPU caches for the source VM, so guest memory contents may remain in caches after the VM is destroyed. The sources do not state a concrete attacker outcome beyond leftover stale data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amd-sev","kvm","linux","runtime","self-hosted","virtualization"],"not_affected_if":["no-intra-host-migration","no-sev-guests"],"how_to_check":"- `uname -r` to see the running kernel version and compare it against the fixed kernel release in the NVD entry\n- unknown whether the sources list affected kernel versions","fix":"- Update the Linux kernel to a release that includes the upstream KVM SEV fix (the sources do not name the fixed version)\n- unknown for the exact patched version","status":"open","published_at":"2026-10-18T16:16:57+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:26:02+00:00","updated_at":"2026-10-25T05:26:02+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:26:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream KVM SEV fix (the sources do not name the fixed version)\n- unknown for the exact patched version","reach":"local","title":"Linux kernel KVM SEV: stale guest data may remain in CPU caches","impact":"low","summary":"During intra-host migration of an SEV guest, the kernel's KVM code did not flush CPU caches for the source VM, so guest memory contents may remain in caches after the VM is destroyed. The sources do not state a concrete attacker outcome beyond leftover stale data.","category":"runtime","nicknames":[],"who_cares":["linux","kvm","amd-sev","self-hosted","virtualization"],"confidence":0.5,"needs_auth":"unknown","worst_case":"stale guest memory data may remain readable in CPU caches","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected and fixed kernel versions and the severity.","how_to_check":"- `uname -r` to see the running kernel version and compare it against the fixed kernel release in the NVD entry\n- unknown whether the sources list affected kernel versions","needs_analyst":true,"not_affected_if":["no-sev-guests","no-intra-host-migration"],"who_is_affected":"Only hosts running KVM with AMD SEV guests that use intra-host migration are relevant, since the flaw concerns cache maintenance when a source VM is converted to a non-SEV VM. Hosts without AMD SEV guests or without this migration path have little reason to act urgently. The sources do not say more about who is affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000646,"input_tokens":3539,"output_tokens":584,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98471':15A,18A 'access':196C 'also':237C 'amd':20B 'amd-sev':19B 'attack':72B 'beyond':74B 'cach':12A,47B,59B,91C,104C,124C,150C,175C 'code':42B 'comparison':217C 'concret':71B 'configur':189C,208C 'content':55B 'convert':135C 'cpu':11A,46B,123C 'cve':13A,16A 'data':7A,77B,119C 'deep':216C 'destin':171C,201C 'destroy':64B,129C 'detach':162C 'doesn':183C 'e.g':152C,220C 'enforc':205C 'ensur':116C 'equival':206C 'flow':146C 'flush':45B 'follow':83C 'guest':6A,37B,53B,155C,187C 'host':27B,32B,100C,113C 'i.e':190C 'ident':186C,229C,238C 'infeas':210C 'intra':31B,99C,112C 'intra-host':30B,98C,111C 'isn':177C 'kernel':2A,39B,81C 'kvm':3A,22B,41B,88C,142C,182C 'left':121C 'leftov':75B 'linux':1A,23B,80C 'mainten':92C,105C,151C,176C 'manual':102C 'may':8A,56B,194C 'memori':54B,144C,156C,188C,198C,207C 'memslot':219C,228C,233C 'migrat':33B,101C,114C 'mmu':165C 'non':139C 'non-sev':138C 'note':167C 'notifi':166C 'option':180C 'outcom':73B 'perform':103C 'point':234C 'reclaim':145C,158C 'reli':168C 'remain':9A,57B 'requir':185C,214C 'resolv':87C 'respons':160C 'runtim':24B 'self':26B 'self-host':25B 'sev':4A,21B,36B,89C,140C 'sourc':50B,66B,95C,108C,132C,192C 'stale':5A,76B,118C 'state':69B 'trigger':149C 'verifi':222C 'virtual':28B 'vm':51B,62B,96C,109C,127C,133C,141C,172C,193C,202C 'vulner':84C 'won':147C 'would':213C","nicknames":[],"mitigations":[],"who_affected":"Only hosts running KVM with AMD SEV guests that use intra-host migration are relevant, since the flaw concerns cache maintenance when a source VM is converted to a non-SEV VM. Hosts without AMD SEV guests or without this migration path have little reason to act urgently. The sources do not say more about who is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98471","severity":null,"published_at":"2026-10-18T16:16:57+00:00","modified_at":"2026-10-19T10:18:57+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}