CVE-2026-98637
kernel: KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 18, 2026
Updated · October 22, 2026
Description
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for ARM64. When a virtual CPU (vCPU) fails to initialize Scalable Vector Extension (SVE) support, feature flags are improperly handled, leaving subsequent vCPUs in an inconsistent state without allocated memory. A guest virtual machine can trigger this issue during floating-point operations to cause a null pointer dereference in the hypervisor, resulting in a Denial of Service (DoS) via a system crash.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CWE-476 · NULL Pointer Dereference