CVE-2026-63938 (GCVE-0-2026-63938)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-08-05 12:37
Severity ?
9.3 (Critical) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change (PSC) requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximum size if the guest provided a pointer that isn't exactly at the start of the GHCB shared buffer.
References
Impacted products
Vendor Product Version
Linux Linux Version: 9b54e248d2644be71cb394eb85f31ad99e023a05
Version: 9b54e248d2644be71cb394eb85f31ad99e023a05
Version: 9b54e248d2644be71cb394eb85f31ad99e023a05
Version: 9b54e248d2644be71cb394eb85f31ad99e023a05
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5198f70c09a5f6e9e5f5a0a2c6b388f24294b176",
              "status": "affected",
              "version": "9b54e248d2644be71cb394eb85f31ad99e023a05",
              "versionType": "git"
            },
            {
              "lessThan": "75c8d1d7291268b479794fba5808971dc2f5eaf3",
              "status": "affected",
              "version": "9b54e248d2644be71cb394eb85f31ad99e023a05",
              "versionType": "git"
            },
            {
              "lessThan": "505a3b94535583e4265360e2621734e355ef263d",
              "status": "affected",
              "version": "9b54e248d2644be71cb394eb85f31ad99e023a05",
              "versionType": "git"
            },
            {
              "lessThan": "121d88de56bc5c0ba0ce2f6381af67f948a7e7c1",
              "status": "affected",
              "version": "9b54e248d2644be71cb394eb85f31ad99e023a05",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Check PSC request indices against the actual size of the buffer\n\nWhen processing Page State Change (PSC) requests, validate the PSC buffer\nagainst the effective size of the scratch area, which could be less than\nthe maximum size if the guest provided a pointer that isn\u0027t exactly at the\nstart of the GHCB shared buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached when malicious code inside an SEV-SNP guest issues a Page State Change VMGEXIT (SVM_VMGEXIT_PSC) through the GHCB, causing a VM exit handled locally by KVM on the host.\nAC:L - The guest fully controls sw_scratch placement, PSC header indices, and entry contents; triggering the out-of-bounds access is deterministic and does not depend on races or conditions outside attacker control.\nPR:N - Exploitation requires only the ability to run code in an SEV-SNP guest (e.g., a cloud confidential-VM tenant), not host root, CAP_SYS_ADMIN, or other elevated host privileges.\nUI:N - No victim user action is required beyond the attacker operating inside their own guest; the malicious VMGEXIT is self-contained.\nS:C - The vulnerability crosses the guest/host security boundary: a guest VM can corrupt host kernel memory via out-of-bounds access during PSC processing, enabling VM escape.\nC:H - Out-of-bounds reads of guest_psc-\u003eentries[idx] via READ_ONCE() can read kernel memory beyond the effective scratch buffer, including data past the GHCB page mapping. Out-of-bounds writes in __snp_complete_one_psc() (guest_psc-\u003eentries[idx].cur_page) corrupt memory beyond the validated buffer, providing a memory corruption primitive exploitable for host code execution. Out-of-bounds reads of guest_psc-\u003eentries[idx] via READ_ONCE() can read kernel memory beyond the effective scratch buffer, including data past the GHCB page mapping.\nI:H - Out-of-bounds writes in __snp_complete_one_psc() (guest_psc-\u003eentries[idx].cur_page) corrupt memory beyond the validated buffer, providing a memory corruption primitive exploitable for host code execution.\nA:H - Out-of-bounds access on the GHCB mapping can cause host kernel oops, panic, or BUG when indices extend past the mapped page boundary."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:25.558Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5198f70c09a5f6e9e5f5a0a2c6b388f24294b176"
        },
        {
          "url": "https://git.kernel.org/stable/c/75c8d1d7291268b479794fba5808971dc2f5eaf3"
        },
        {
          "url": "https://git.kernel.org/stable/c/505a3b94535583e4265360e2621734e355ef263d"
        },
        {
          "url": "https://git.kernel.org/stable/c/121d88de56bc5c0ba0ce2f6381af67f948a7e7c1"
        }
      ],
      "title": "KVM: SEV: Check PSC request indices against the actual size of the buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63938",
    "datePublished": "2026-07-19T14:55:35.168Z",
    "dateReserved": "2026-07-19T07:54:57.022Z",
    "dateUpdated": "2026-08-05T12:37:25.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.