CVE-2026-98716 (GCVE-0-2026-98716)
Vulnerability from cvelistv5
Published
2026-10-18 15:46
Modified
2026-10-30 12:39
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted Use the MSR permission bitmap of the active VMCB instead of assuming that KVM is always using vmcb02's bitmap when L2 is active, as KVM uses msrpm02 if and only if L1 wants to intercept MSR accesses, i.e. if and only if KVM needs to merge msprm01 with msrpm12. Don't bother tracking the virtual address of the bitmap that's being used, as __va() is cheap on x86, and caching the virtual address would introduce yet another source of potentially stale information.
References
Impacted products
Vendor Product Version
Linux Linux Version: b2ac58f90540e39324e7a29a7ad471407ae0bf48
Version: b2ac58f90540e39324e7a29a7ad471407ae0bf48
Version: b2ac58f90540e39324e7a29a7ad471407ae0bf48
Version: b2ac58f90540e39324e7a29a7ad471407ae0bf48
Version: b2ac58f90540e39324e7a29a7ad471407ae0bf48
Version: b2ac58f90540e39324e7a29a7ad471407ae0bf48
Version: b2ac58f90540e39324e7a29a7ad471407ae0bf48
Version: b2ac58f90540e39324e7a29a7ad471407ae0bf48
Version: f54d0bb8487d2f016fbc4f0e38ef9098f8eb8bd4
Version: 89be8950bab799ddb9cc3777345e3c21bcb32dba
Version: 3.16.57   ≤
Version: 4.4.168   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "001c78bc64389cabe4f9015ab3942ec9c3592caa",
              "status": "affected",
              "version": "b2ac58f90540e39324e7a29a7ad471407ae0bf48",
              "versionType": "git"
            },
            {
              "lessThan": "552a110c403f1a61eba0bf71519c6585d9d4242d",
              "status": "affected",
              "version": "b2ac58f90540e39324e7a29a7ad471407ae0bf48",
              "versionType": "git"
            },
            {
              "lessThan": "0e79ebf6f92a7d15187aede44204fa04b93e474c",
              "status": "affected",
              "version": "b2ac58f90540e39324e7a29a7ad471407ae0bf48",
              "versionType": "git"
            },
            {
              "lessThan": "84da7a0e92207444d9cbfe69965e17db29008f27",
              "status": "affected",
              "version": "b2ac58f90540e39324e7a29a7ad471407ae0bf48",
              "versionType": "git"
            },
            {
              "lessThan": "74836ae4785b9754bb36d0b18fcc1dec4e5e98d2",
              "status": "affected",
              "version": "b2ac58f90540e39324e7a29a7ad471407ae0bf48",
              "versionType": "git"
            },
            {
              "lessThan": "318ef696fa3c712e46bb62a1a828c3cd62f390c3",
              "status": "affected",
              "version": "b2ac58f90540e39324e7a29a7ad471407ae0bf48",
              "versionType": "git"
            },
            {
              "lessThan": "55865b3ae03705aa39198783b9cb1f8b96eb44e4",
              "status": "affected",
              "version": "b2ac58f90540e39324e7a29a7ad471407ae0bf48",
              "versionType": "git"
            },
            {
              "lessThan": "9e06bbb9ade7cdf28d4a3b5b14e5812881c8df85",
              "status": "affected",
              "version": "b2ac58f90540e39324e7a29a7ad471407ae0bf48",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f54d0bb8487d2f016fbc4f0e38ef9098f8eb8bd4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "89be8950bab799ddb9cc3777345e3c21bcb32dba",
              "versionType": "git"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.57",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.168",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.273",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.224",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.56",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.10",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.57",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.168",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Use the active VMCB\u0027s MSR bitmap when checking if MSR is intercepted\n\nUse the MSR permission bitmap of the active VMCB instead of assuming that\nKVM is always using vmcb02\u0027s bitmap when L2 is active, as KVM uses msrpm02\nif and only if L1 wants to intercept MSR accesses, i.e. if and only if KVM\nneeds to merge msprm01 with msrpm12.\n\nDon\u0027t bother tracking the virtual address of the bitmap that\u0027s being used,\nas __va() is cheap on x86, and caching the virtual address would introduce\nyet another source of potentially stale information."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:39:03.485Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/001c78bc64389cabe4f9015ab3942ec9c3592caa"
        },
        {
          "url": "https://git.kernel.org/stable/c/552a110c403f1a61eba0bf71519c6585d9d4242d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e79ebf6f92a7d15187aede44204fa04b93e474c"
        },
        {
          "url": "https://git.kernel.org/stable/c/84da7a0e92207444d9cbfe69965e17db29008f27"
        },
        {
          "url": "https://git.kernel.org/stable/c/74836ae4785b9754bb36d0b18fcc1dec4e5e98d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/318ef696fa3c712e46bb62a1a828c3cd62f390c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/55865b3ae03705aa39198783b9cb1f8b96eb44e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e06bbb9ade7cdf28d4a3b5b14e5812881c8df85"
        }
      ],
      "title": "KVM: SVM: Use the active VMCB\u0027s MSR bitmap when checking if MSR is intercepted",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98716",
    "datePublished": "2026-10-18T15:46:49.960Z",
    "dateReserved": "2026-09-25T10:25:14.366Z",
    "dateUpdated": "2026-10-30T12:39:03.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.