CVE-2026-98471

KVM SEV intra host migration can leave stale or dirty source VM data in CPU caches because the source VM is converted to a non SEV VM before normal memory reclaim can perform the required cache maintenance. Cache lines associated with memory available only to the source VM may therefore survive after the source VM is destroyed, since the destination VM is not required to have an identical memory configuration. This creates a potential SEV isolation failure involving disclosure of cached guest data, loss of dirty guest writes, or corruption when affected memory is reclaimed or reused. For the CVSS the PR:L value is used because triggering requires access to the relevant KVM VM file descriptors and migration controls, but this access may belong to a restricted virtualization service account rather than a fully privileged host administrator. The issue is local and is not directly network reachable. A guest can influence cached memory contents but normally cannot initiate the encryption context migration without cooperation from host userspace. Impact is potentially broader than denial of service and may include confidentiality and integrity effects across a VM isolation boundary. The exact exploitability depends on cache residency, SEV hardware behavior, source and destination memory layouts, and the ability to control the migration sequence.