CVE-2026-74607

A flaw was found in the Kernel-based Virtual Machine (KVM) Secure Virtual Machine (SVM) module within the Linux kernel. This vulnerability involves a race condition during the management of encrypted virtual machine contexts, specifically when handling owner and mirror lists. A privileged user or malicious guest virtual machine could exploit this timing issue during concurrent operations, such as virtual machine migration or destruction. This could lead to corruption of internal data structures or incorrect handling of virtual machine resources, potentially resulting in system instability or a denial of service.

A race condition flaw with Moderate security impact was found in the KVM SVM (AMD Secure Encrypted Virtualization) support of the Linux kernel used in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. Interaction between the KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM operations, together with concurrent virtual machine destruction, accesses the SEV owner and mirror virtual machine lists without consistent locking: sev_migrate_from() can move a mirror entry from a source list to the owner's mirror_vms list without holding the owner's lock, and sev_vm_destroy() can apply kvm_put_kvm() to the wrong virtual machine if the owner concurrently receives a MOVE that changes sev->enc_context_owner. A local user with privileges to issue these KVM operations on an AMD SEV capable host, or a malicious guest virtual machine, could exploit this timing race to corrupt KVM internal data structures or mishandle virtual machine resources, potentially causing a kernel panic and denial of service of the host.

The vulnerable code, which allows SEV intra-host migration of VMs with mirrors and was introduced upstream in Linux 5.18, was backported into Red Hat Enterprise Linux starting with the 8.7 release; therefore Red Hat Enterprise Linux 6 and 7, and the 8.4 and 8.6 update streams (kernel and kernel-rt), are not affected because the vulnerable code is not present. For the affected Red Hat Enterprise Linux 8, 9, and 10 streams and the Red Hat In-Vehicle OS streams, the fix is currently deferred: correctly serializing these paths requires reworking the locking around SEV encrypted-context migration, and because Red Hat assesses the practical impact as availability only, the fix will be delivered in a future update rather than as an urgent fix. The residual risk is that a local privileged user able to trigger the small race window on an AMD SEV KVM host could crash the host kernel.

Red Hat rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the realistic impact is denial of service with unchanged scope. The CVE.org record assigns a higher score (CVSS 8.8) by assuming high confidentiality and integrity impact and a scope change, which Red Hat's assessment does not support.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.