Live › vulnerability › CVE-2026-98928
Go to dashboardIn the Linux kernel's arm64 KVM, a host can set the guest SVE flag without the matching feature bit, leaving a vCPU with a NULL SVE state. The world switch then loads guest SVE state from that null pointer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running arm64 Linux with KVM and protected VMs (pKVM) are the systems that would see this path. The sources do not say which kernel versions are affected or which configurations trigger it, so the exact exposure is unknown.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2
pkvm_init_features_from_host() takes KVM_ARCH_FLAG_GUEST_HAS_SVE and KVM_ARM_VCPU_SVE from the host separately, but pkvm_vcpu_init_sve() tests the bit while vcpu_has_sve() reads the flag. A host that sets the flag without the bit gets a vCPU with a NULL sve_state that the world switch loads the guest's SVE state from.
Derive the flag from the bit, and drop the protected path's copy of the host's flag, which is dead code since protected VMs are not allowed SVE.
This page as .md · .json · in your agent: get_signal("CVE-2026-98928")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.