Executive brief
A vulnerability in the Linux kernel's virtualization component (KVM) could allow the system to overwrite read-only memory when setting up secure virtual machines. This occurs when the system attempts to correct configuration data provided by the user; if that data is stored in a read-only area, the kernel may still attempt to write to it. While most standard virtualization software is not affected, this could potentially lead to system instability or unintended memory modifications.
Technical details
A vulnerability in KVM's SEV-SNP implementation arises during the population of 'guest_memfd' with initial CPUID data. When userspace provides CPUID data that is rejected by trusted firmware, KVM attempts to write back the 'correct' information to the source page using a kernel mapping. Previously, KVM only acquired a read-only pin on these source pages. If the source mapping is backed by read-only memory, this kernel-mode write results in clobbering read-only memory. The fix ensures that a writable pin (FOLL_WRITE) is acquired when the page type is KVM_SEV_SNP_PAGE_TYPE_CPUID. This requires local access to initiate guest VM creation.
Affected products
- Linux Linux 7.0 to 7.1.4
Timeline
- 2026-05-22: disclosed: Initial patch submitted by Google engineers
- 2026-07-25: advisory: CVE-2026-64285 published