Cloudanix VulnDB

CVE-2026-98714

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel issue affecting virtual machines on AMD chips was corrected to keep internal control data consistent and avoid unexpected behavior.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

KVM AMD SVM incorrectly updated control.erap_ctl and control.clean fields in the VMCS on #VMEXIT even when VMRUN failed, leaving guest control state in an undefined condition contrary to AMD architectural guidance.

Why it matters to the business

Low-probability risk of virtualization instability or weakened isolation on Linux hosts running AMD processors; recent publication and minimal exploit likelihood reduce immediate operational concern.

How an attack unfolds

An attacker with the ability to induce repeated VMRUN failures from a guest could potentially observe or influence stale control fields, though no public exploitation techniques or threat actors are associated with this issue.

How to fix it

Upgrade the Linux kernel to a version containing the referenced KVM SVM fix; rebuild and reboot affected hosts.

How to confirm the fix worked

Confirm the presence of the commit that conditions updates to control.erap_ctl and control.clean on VMRUN success; test VMRUN failure paths in a lab environment.

Typical attack path

  1. Obtain code execution inside an AMD SVM guest
  2. Craft inputs that force VMRUN to fail
  3. Trigger #VMEXIT and inspect or abuse uncleared control fields
  4. Attempt to escape guest boundaries or destabilize the hypervisor

How to detect it

Search hypervisor logs and dmesg for repeated VMRUN failure messages around KVM SVM activity; no widespread exploitation has been reported.

What your security team should do

  • Prioritize kernel updates on AMD virtualization hosts within standard patching windows
  • Review KVM SVM logs for unusual VMRUN failure rates
  • Track EPSS and KEV status for any change in exploit maturity

The record

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded Leave control.erap_ctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD: there's no explicit architectural guarantee about the behavior in the presence of VMRUN failures. So the best thing to do would be to assume that if VMRUN fails, the actions requested in the control fields may not have been performed.

Affected packages

Ecosystem Package Introduced Fixed