Deadlock in Linux kernel - CVE-2026-98871

Vulnerability details

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering a deadlock during SEV initialization.

The vulnerability exists due to incorrect lock-state handling in __sev_platform_init_handle_init_ex_path() when processing an SEV initialization failure. The function calls rmp_mark_pages_firmware() with locked=false despite its parent already holding sev_cmd_mutex. If RMPUPDATE fails for a page after the first, cleanup attempts to reclaim pages and deadlocks in sev_do_cmd. A local privileged user can potentially trigger this failure path to prevent SEV command processing from completing.

Affected software

How to mitigate CVE-2026-98871

External References

• https://git.kernel.org/stable/c/364f3841bc22c72b6e2cb72a1e3c91c9c8fc1ef4
• https://git.kernel.org/stable/c/8e7e06ee7c2938ee3fa31a61cc5289a45c8c13f1
• https://git.kernel.org/stable/c/b0e7ec0dab242c5e480121ba12400d0513e37ca2
• https://git.kernel.org/stable/c/ffd3a3df92be697eb78118a146c6a5d5e6c1f724

Related Security Bulletins

• Deadlock in Linux kernel crypto ccp driver