# CVE-2026-53360: Linux Kernel KVM SEV heap overflow in GHCB scratch area

Source: https://junglewise.ai/threats/cve-2026-53360-linux-kernel-kvm-sev-heap-overflow-in-ghcb-scratch-area  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-04. Updated: 2026-07-04  
License: CC BY 4.0 with a link back

CVE-2026-53360 · Severity: info · CVSS 8.8 · Published 2026-07-04

A vulnerability in the Linux kernel's virtualization component (KVM) could allow a malicious guest virtual machine to compromise the host server. By exploiting flaws in how the system handles secure memory requests, an attacker could steal sensitive information from the host's memory or cause the entire system to crash. This affects servers using AMD SEV-SNP technology to run secure virtual machines.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-53360 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53360 being exploited in the wild.

**How severe is CVE-2026-53360?** Informational severity, with a CVSS score of 8.8, published 4 July 2026.

**Which products and versions are affected?** Linux Kernel GHCB v2+ support in KVM SEV-SNP.

**Is there a fix for CVE-2026-53360?** A patch was published on 2026-05-01: Initial patch authored by Michael Roth Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53360 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-53360?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the KVM SEV-SNP implementation within the Linux kernel due to insufficient validation of the software scratch area when GHCB v2+ is in use. The function `setup_vmgexit_scratch()` allows guest-controlled allocation sizes via `exit_info_2`, while `snp_begin_psc()` fails to validate the `end_entry` index against the actual allocated buffer size, checking only against a static maximum. A malicious guest can trigger out-of-bounds (OOB) reads and writes by providing a small allocation size and a large entry index. This can lead to host heap layout disclosure, heap corruption, and use-after-free conditions. The fix enforces that the scratch area must reside within the GHCB shared buffer for GHCB v2+ requests.

## Affected products

- Linux Linux Kernel GHCB v2+ support in KVM SEV-SNP

## Timeline

- 2026-05-01: patched: Initial patch authored by Michael Roth
- 2026-07-04: advisory: CVE published to NVD dataset

## References

- [https://git.kernel.org/stable/c/b328ede59ac34e7998e1eee5e5f0cc26c2a91846](https://git.kernel.org/stable/c/b328ede59ac34e7998e1eee5e5f0cc26c2a91846)
- [https://git.kernel.org/stable/c/bf9ba093fbb83c0c9a3dedd50efec29424eca2fc](https://git.kernel.org/stable/c/bf9ba093fbb83c0c9a3dedd50efec29424eca2fc)
- [https://git.kernel.org/stable/c/c9b4198fbc6ed99a9da4bee9f74bb730f926c9ae](https://git.kernel.org/stable/c/c9b4198fbc6ed99a9da4bee9f74bb730f926c9ae)
- [https://git.kernel.org/stable/c/db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7](https://git.kernel.org/stable/c/db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)