Executive brief
A vulnerability was identified in the Linux kernel's virtualization component (KVM) specifically affecting AMD SEV (Secure Encrypted Virtualization). The issue involves how the system calculates memory buffer sizes when a guest operating system requests changes to its memory state. If exploited, this could lead to a buffer overflow, potentially allowing a guest virtual machine to crash the host system or compromise its stability.
Technical details
A buffer overflow vulnerability exists in the Linux kernel's KVM implementation for AMD SEV-ES/SEV-SNP. The root cause is an incorrect calculation of the maximum length of the Guest-Hypervisor Communication Block (GHCB) scratch area in `arch/x86/kvm/svm/sev.c`. While MMIO emulation correctly treats the length as a maximum, Page State Change (PSC) requests treat the provided length as a minimum requirement. This discrepancy allows for potential buffer overflows because KVM does not properly account for the full size of the scratch area relative to the shared buffer's end. The vulnerability is reachable via VMGEXIT calls from a guest. Patches have been released across multiple stable kernel branches (6.12.93, 6.18.35, 7.0.12) to ensure the effective length is capped by the shared buffer boundaries.
Affected products
- Linux Linux 6.11, 6.12, 6.18, 7.0
Timeline
- 2026-05-01: other: Patch authored by Sean Christopherson
- 2026-07-19: advisory: CVE-2026-63939 published