---
id: "CVE-2026-98714"
kind: "vulnerability"
aliases: ["CVE-2026-98714"]
title: "Linux kernel KVM: SVM control fields updated after failed VMRUN"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["amd-svm", "kvm", "linux-kernel", "runtime", "self-hosted", "virtualization"]
not_affected_if: ["intel-only-hosts", "no-kvm"]
published_at: "2026-10-18T16:17:24+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:17:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98714", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel KVM: SVM control fields updated after failed VMRUN

The Linux kernel's KVM AMD SVM code updated VMCB control fields on VM exit even when VMRUN had failed, where AMD says those actions may not have been performed. The sources do not state what an attacker gains from this.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` to see the running kernel version
- Check whether the host runs KVM with AMD SVM: `lsmod | grep kvm_amd`
- Compare the kernel against the fixed version listed in the kernel stable advisory (unknown from these sources)

## Fix

- Update the Linux kernel to a release that includes the upstream commit titled 'KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded' (fixed version unknown from these sources)

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98714

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded

Leave control.erap_ctl and control.clean as-is in the VMCS if VMRUN fails,
because as per AMD:

  there's no explicit architectural guarantee about the behavior in the
  presence of VMRUN failures. So the best thing to do would be to assume
  that if VMRUN fails, the actions requested in the control fields may not
  have been performed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_