{"id":"CVE-2026-98714","kind":"vulnerability","aliases":["CVE-2026-98714"],"related":[],"title":"Linux kernel KVM: SVM control fields updated after failed VMRUN","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded\n\nLeave control.erap_ctl and control.clean as-is in the VMCS if VMRUN fails,\nbecause as per AMD:\n\n  there's no explicit architectural guarantee about the behavior in the\n  presence of VMRUN failures. So the best thing to do would be to assume\n  that if VMRUN fails, the actions requested in the control fields may not\n  have been performed.","summary":"The Linux kernel's KVM AMD SVM code updated VMCB control fields on VM exit even when VMRUN had failed, where AMD says those actions may not have been performed. The sources do not state what an attacker gains from this.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amd-svm","kvm","linux-kernel","runtime","self-hosted","virtualization"],"not_affected_if":["intel-only-hosts","no-kvm"],"how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the host runs KVM with AMD SVM: `lsmod | grep kvm_amd`\n- Compare the kernel against the fixed version listed in the kernel stable advisory (unknown from these sources)","fix":"- Update the Linux kernel to a release that includes the upstream commit titled 'KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded' (fixed version unknown from these sources)","status":"open","published_at":"2026-10-18T16:17:24+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:31+00:00","updated_at":"2026-10-25T05:17:31+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:17:31Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit titled 'KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded' (fixed version unknown from these sources)","reach":"local","title":"Linux kernel KVM: SVM control fields updated after failed VMRUN","impact":"medium","summary":"The Linux kernel's KVM AMD SVM code updated VMCB control fields on VM exit even when VMRUN had failed, where AMD says those actions may not have been performed. The sources do not state what an attacker gains from this.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","kvm","amd-svm","self-hosted","virtualization"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; impact not described in the sources","analyst_note":"Check the NVD entry and the kernel stable git commit for the fixed kernel versions and the actual security impact of the VMRUN failure path.","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the host runs KVM with AMD SVM: `lsmod | grep kvm_amd`\n- Compare the kernel against the fixed version listed in the kernel stable advisory (unknown from these sources)","needs_analyst":true,"not_affected_if":["intel-only-hosts","no-kvm"],"who_is_affected":"Hosts running Linux with KVM on AMD processors using SVM, where guest virtual machines are run. Systems without KVM on AMD hardware are not affected by this code path. The sources do not say what triggers the flaw or what a guest or attacker can do with it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000646,"input_tokens":3395,"output_tokens":612,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98714':13A,16A 'action':53B,139C 'amd':18B,34B,50B,108C 'amd-svm':17B 'architectur':113C 'as-i':96C 'assum':133C 'attack':66B 'behavior':117C 'best':126C 'code':36B 'control':5A,39B,81C,143C 'control.clean':95C 'control.erap':92C 'ctl':93C 'cve':11A,14A 'even':44B 'exit':43B 'explicit':112C 'fail':9A,48B,104C,137C 'failur':123C 'field':6A,40B,82C,144C 'follow':73C 'gain':67B 'guarante':114C 'host':27B 'kernel':2A,23B,31B,71C 'kvm':3A,20B,33B,78C 'leav':91C 'linux':1A,22B,30B,70C 'linux-kernel':21B 'may':54B,145C 'per':107C 'perform':58B,149C 'presenc':120C 'request':140C 'resolv':77C 'runtim':24B 'say':51B 'self':26B 'self-host':25B 'sourc':60B 'state':63B 'succeed':90C 'svm':4A,19B,35B,79C 'thing':127C 'updat':7A,37B,80C 'virtual':28B 'vm':42B 'vmcb':38B 'vmcs':101C 'vmexit':84C 'vmrun':10A,46B,89C,103C,122C,136C 'vulner':74C 'would':130C","nicknames":[],"mitigations":[],"who_affected":"Hosts running Linux with KVM on AMD processors using SVM, where guest virtual machines are run. Systems without KVM on AMD hardware are not affected by this code path. The sources do not say what triggers the flaw or what a guest or attacker can do with it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98714","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98714","severity":null,"published_at":"2026-10-18T16:17:24+00:00","modified_at":"2026-10-19T10:19:35+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}