Executive brief
A vulnerability in the Linux kernel's SEV-guest driver could lead to memory corruption or security bypasses when handling encrypted memory pages. In certain failure scenarios, the system might incorrectly return unencrypted memory pages to the general pool, potentially exposing sensitive data or allowing unauthorized access. This issue primarily affects virtual machines using AMD SEV-SNP technology.
Technical details
A vulnerability exists in the Linux kernel 'sev-guest' driver within the 'get_ext_report' function. When 'set_memory_encrypted()' or 'set_memory_decrypted()' fails, the state of the affected memory pages becomes unknown. Previously, the kernel might attempt to free these pages back to the buddy allocator; however, if they remain in an unencrypted state, they are unsuitable for general use and could lead to security compromises. The fix involves explicitly leaking these pages using 'snp_leak_pages()' to ensure they are never reused by the system in an insecure state. This issue affects systems utilizing AMD Secure Nested Paging (SNP).
Affected products
- Linux Linux Kernel 6.13.8, 6.14, 7.0.11
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory