Executive brief
A vulnerability was identified in the Linux kernel's SEV-guest driver, which manages secure communication between a virtual machine and its host. A malicious or compromised host could provide an invalid data length during a specific request, causing the guest operating system to incorrectly free memory. This could lead to system instability or memory corruption within the virtual machine.
Technical details
A vulnerability exists in the Linux kernel's 'virt: sev-guest' driver within the get_ext_report() function. When performing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST), the driver allocates a buffer for certificate blobs. If the host returns an error indicating an invalid length (SNP_GUEST_VMM_ERR_INVALID_LEN), the driver updates its internal length tracker with the host-provided value. During the subsequent cleanup path, the driver uses this host-controlled value to calculate the page order for deallocation. Because this value may not match the original allocation's page order, it can lead to corruption in the kernel page allocator. The fix replaces alloc_pages() with alloc_pages_exact() to ensure consistent tracking of the number of pages to be freed.
Affected products
- Linux Linux Kernel 6.13.8, 6.14, 6.18.33, 7.0.10
Timeline
- 2026-05-17: patched: Initial fix committed to mainline kernel by Linus Torvalds.
- 2026-06-24: disclosed: CVE-2026-52959 published.