---
id: "CVE-2026-98718"
kind: "vulnerability"
aliases: ["CVE-2026-98718"]
title: "Linux KVM: cache flush ordering lets reclaimed SEV guest memory corrupt host pages"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["amd-sev", "hypervisor", "kvm", "linux", "runtime"]
not_affected_if: ["no-amd-sev-guests", "no-kvm"]
published_at: "2026-10-18T16:17:25+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:17:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98718", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux KVM: cache flush ordering lets reclaimed SEV guest memory corrupt host pages

In the Linux kernel's KVM SEV code, the source VM's caches were flushed after its SEV active state was cleared during intra-host migration, leaving a race window. A reclaimed page could receive stale encrypted guest data written over the new owner's contents.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update the Linux kernel to a release that includes the upstream fix (the sources do not name a version).

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98718

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state

Explicitly flush caches after intra-host migration before clearing "SEV
active" on the source VM, as doing cache maintenance afterwards creates a
tiny window where memory reclaim could return memory to the host without
performing a cache flush, e.g. as pointed out by Sashiko:

  CPU1 in sev_migrate_from():
    src->active = false;

  CPU2 running concurrent unmap:
    Since active is false, the automatic cache flush in
    sev_guest_memory_reclaimed is skipped.
    The host frees and reallocates the page.

  CPU1 in sev_migrate_from():
    sev_writeback_caches(src_kvm);
    Executes a hardware cache flush (wbnoinvd), which writes the guest's old
    dirty ciphertext over the new page owner's data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_