Executive brief
A vulnerability in the Linux kernel's virtualization component (KVM) could allow a local user to crash the system. By providing an extremely large memory size during a specific operation related to encrypted virtual machines, an attacker can trigger an internal kernel warning and potential failure. This affects systems using AMD SEV technology for secure virtual machine isolation.
Technical details
The vulnerability exists in the `sev_pin_memory()` function within the KVM SEV (Secure Encrypted Virtualization) implementation for AMD processors. The root cause is an integer overflow check that uses `WARN_ON_ONCE()` when the number of pages (`npages`) exceeds `INT_MAX`. Because this condition can be easily triggered by a local user via the `KVM_MEMORY_ENCRYPT_REG_REGION` ioctl with a large `size` value (e.g., `-1ul`), it allows unprivileged or low-privileged users to spam the kernel log with warnings or trigger 'panic on warn' configurations. The fix replaces the `WARN_ON_ONCE` with a standard error return (`-EINVAL`) and moves the check earlier in the function.
Affected products
- Linux Linux Kernel 5.9 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-04-22: patched
References
- https://git.kernel.org/stable/c/1cba4dcd795daf6d257122779fb6a349edf03914
- https://git.kernel.org/stable/c/28cc13ca20431b127d42d84ba10898d03e2c8267
- https://git.kernel.org/stable/c/6a8e3c82122737529b25ef2a048fbcc569d8c055
- https://git.kernel.org/stable/c/8acffeef5ef720c35e513e322ab08e32683f32f2
- https://git.kernel.org/stable/c/a703933bcfa5cc76ca10e2048464600e74136099
- https://git.kernel.org/stable/c/ab423e5892826202a660b5ac85d1125b0e8301a5
- https://git.kernel.org/stable/c/abcd43ff579abd0a654bb4636086e78819dd5f4c