CVE-2026-98718

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem supporting AMD SEV (Secure Encrypted Virtualization). During virtual machine migration on the same host, CPU cache maintenance was performed after deactivating the source guest's encryption state instead of before. This timing window allows concurrent host memory reclaim operations to reallocate guest memory pages before caches are flushed. As a result, subsequent delayed cache writebacks can overwrite newly allocated memory with stale guest data, leading to memory corruption and host system instability.

This vulnerability is rated as an Important severity flaw because corrupting host memory undermines hypervisor integrity and can crash the host, even though exploitation requires specific timing during intra-host migration. Red Hat Enterprise Linux environments are only affected if the KVM hypervisor is running on AMD hardware with Secure Encrypted Virtualization (SEV) enabled. Systems hosting standard unencrypted virtual machines or operating on non-AMD platforms are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.