CVE-2026-98716 KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
A flaw in Linux KVM SVM allows bypassing MSR interception checks, potentially enabling guest-to-host security bypasses.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98716?
CVE-2026-98716 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
Use the MSR permission bitmap of the active VMCB instead of assuming that KVM is always using vmcb02's bitmap when L2 is active, as KVM uses msrpm02 if and only if L1 wants to intercept MSR accesses, i.e. if and only if KVM needs to merge msprm01 with msrpm12.
Don't bother tracking the virtual address of the bitmap that's being used, as __va() is cheap on x86, and caching the virtual address would introduce yet another source of potentially stale information.
Which versions are affected by CVE-2026-98716?
How do I fix CVE-2026-98716?
Apply the vendor's patch.
Is CVE-2026-98716 being exploited?
There is no known exploitation of CVE-2026-98716 in the wild and no public exploit code.
Sources
Also known as AZL-109439, BELL-CVE-2026-98716, DEBIAN-CVE-2026-98716, GHSA-hpgm-5w85-35mm, UBUNTU-CVE-2026-98716.