SB20261022320 - Improper control of a resource through its lifetime in Linux kernel kvm svm

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98715)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 7.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially bypass memory isolation and access or modify memory through stale address translations.

The vulnerability exists due to improper invalidation of cached address translations in the Linux kernel KVM SVM component when a VMRUN instruction fails. A local user can exploit a dropped pending TLB flush to potentially access or modify memory through stale translations, including translations retained when an address space identifier (ASID) is reused.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/60d93c27859fb3ec5b5a689e24de303f166477d0
• https://git.kernel.org/stable/c/fd873c3d1b5240e80365f09e758e8c96b88a7cdb