https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 03 Nov 2026 09:25:38 +0000 https://db.gcve.eu/vuln/cve-2026-98719 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>KVM: SEV: Nullify &#34;have run CPUs&#34; mask pointer when freeing it</p> <p>Nullify have_run_cpus when freeing the mask, particularly in the error path of __sev_guest_init(), so that KVM doesn&#39;t have to subtly use sev-&gt;active to track whether or not the mask has been freed. As pointed out by Sashiko, blindly freeing the mask in sev_vm_destroy() results in a double-free if the mask is freed if __sev_guest_init() fails.</p> <p>Throw the logic in a helper as nullifying the pointer is frustratingly difficult and weird due to have_run_cpus being a single-entry array when CPUMASK_OFFSTACK=n. Deliberately don&#39;t use CPUMASK_VAR_NULL, as it&#39;s not directly assignable when the cpumask is on-stack, e.g. requires using a local variable and a memcpy(), which is beyond ridiculous. Furthermore, while clearing the on-stack bitmask is an unnecessary and arguably unwanted side effect, KVM absolutely relies on &#39;0&#39; being the &#34;null&#34; value given that the struct is zero-allocated.</p> <p>Opportunistically add an alloc() helper to pair with free(); there are just enough call sites to make doing so worthwhile.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>KVM: SEV: Nullify &#34;have run CPUs&#34; mask pointer when freeing it</p> <p>Nullify have_run_cpus when freeing the mask, particularly in the error path of __sev_guest_init(), so that KVM doesn&#39;t have to subtly use sev-&gt;active to track whether or not the mask has been freed. As pointed out by Sashiko, blindly freeing the mask in sev_vm_destroy() results in a double-free if the mask is freed if __sev_guest_init() fails.</p> <p>Throw the logic in a helper as nullifying the pointer is frustratingly difficult and weird due to have_run_cpus being a single-entry array when CPUMASK_OFFSTACK=n. Deliberately don&#39;t use CPUMASK_VAR_NULL, as it&#39;s not directly assignable when the cpumask is on-stack, e.g. requires using a local variable and a memcpy(), which is beyond ridiculous. Furthermore, while clearing the on-stack bitmask is an unnecessary and arguably unwanted side effect, KVM absolutely relies on &#39;0&#39; being the &#34;null&#34; value given that the struct is zero-allocated.</p> <p>Opportunistically add an alloc() helper to pair with free(); there are just enough call sites to make doing so worthwhile.</p> https://db.gcve.eu/vuln/cve-2026-98719