Live › vulnerability › CVE-2026-98637
Go to dashboardWhen SVE setup fails for one vCPU in a pKVM arm64 guest, later vCPUs on the same VM skip SVE setup and are registered with a NULL SVE state. The guest's first floating-point access then passes that NULL pointer into sve_load_state(), which can crash the host kernel.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running the Linux kernel KVM hypervisor on arm64 with protected KVM (pKVM) and SVE-capable vCPUs are the relevant case. The sources do not say which configurations beyond that are affected, so treat the scope as unknown.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure
pkvm_vcpu_init_sve() clears KVM_ARM_VCPU_SVE in kvm->arch.vcpu_features when it fails, but vcpu_has_sve() tests KVM_ARCH_FLAG_GUEST_HAS_SVE, which is left set. Later vCPUs on that VM then skip the SVE setup and register with a NULL sve_state, which the guest's first FP access hands to sve_load_state().
Return the error without touching vcpu_features.
This page as .md · .json · in your agent: get_signal("CVE-2026-98637")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.