Is CVE-2026-53360 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53360 being exploited in the wild.

How severe is CVE-2026-53360?

Informational severity, with a CVSS score of 8.8, published 4 July 2026.

Which products and versions are affected?

Linux Kernel GHCB v2+ support in KVM SEV-SNP.

Is there a fix for CVE-2026-53360?

A patch was published on 2026-05-01: Initial patch authored by Michael Roth Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53360 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-53360?

Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53360: Linux Kernel KVM SEV heap overflow in GHCB scratch area

CVE-2026-53360 · Severity: info · CVSS 8.8 · Published 2026-07-04

A vulnerability in the Linux kernel's virtualization component (KVM) could allow a malicious guest virtual machine to compromise the host server. By exploiting flaws in how the system handles secure memory requests, an attacker could steal sensitive information from the host's memory or cause the entire system to crash. This affects servers using AMD SEV-SNP technology to run secure virtual machines.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-53360 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53360 being exploited in the wild.
How severe is CVE-2026-53360?: Informational severity, with a CVSS score of 8.8, published 4 July 2026.
Which products and versions are affected?: Linux Kernel GHCB v2+ support in KVM SEV-SNP.
Is there a fix for CVE-2026-53360?: A patch was published on 2026-05-01: Initial patch authored by Michael Roth Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53360 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-53360?: Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the KVM SEV-SNP implementation within the Linux kernel due to insufficient validation of the software scratch area when GHCB v2+ is in use. The function `setup_vmgexit_scratch()` allows guest-controlled allocation sizes via `exit_info_2`, while `snp_begin_psc()` fails to validate the `end_entry` index against the actual allocated buffer size, checking only against a static maximum. A malicious guest can trigger out-of-bounds (OOB) reads and writes by providing a small allocation size and a large entry index. This can lead to host heap layout disclosure, heap corruption, and use-after-free conditions. The fix enforces that the scratch area must reside within the GHCB shared buffer for GHCB v2+ requests.

Affected products

Linux Linux Kernel GHCB v2+ support in KVM SEV-SNP

Timeline

2026-05-01: patched: Initial patch authored by Michael Roth
2026-07-04: advisory: CVE published to NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.