CVE-2026-63940 (GCVE-0-2026-63940)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-08-05 12:37
Severity ?
9.3 (Critical) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.
References
Impacted products
Vendor Product Version
Linux Linux Version: 291bd20d5d88814a73d43b55b9428feab2f28094
Version: 291bd20d5d88814a73d43b55b9428feab2f28094
Version: 291bd20d5d88814a73d43b55b9428feab2f28094
Version: 291bd20d5d88814a73d43b55b9428feab2f28094
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3b6035bc6bff20e89752ce4358bc4c9a9d5883f2",
              "status": "affected",
              "version": "291bd20d5d88814a73d43b55b9428feab2f28094",
              "versionType": "git"
            },
            {
              "lessThan": "2254972d4d69e279ba4e87bf0968eb08ad0d3c92",
              "status": "affected",
              "version": "291bd20d5d88814a73d43b55b9428feab2f28094",
              "versionType": "git"
            },
            {
              "lessThan": "c30cde934c7813b4e3069765dac64ce3d31e34f2",
              "status": "affected",
              "version": "291bd20d5d88814a73d43b55b9428feab2f28094",
              "versionType": "git"
            },
            {
              "lessThan": "3988bd2723de407ae90fa7a6f6029b4e60238c58",
              "status": "affected",
              "version": "291bd20d5d88814a73d43b55b9428feab2f28094",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Ignore Port I/O requests of length \u00270\u0027\n\nExplicitly ignore Port I/O requests of length \u00270\u0027 (or count \u00270\u0027), so that\nsetting up the software scratch area (and other code) doesn\u0027t have to\nworry about underflowing the length, and to allow for WARNing on trying\nto configure the scratch area with len==0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached when a SEV-ES/SEV-SNP guest triggers a #VMGEXIT with a crafted GHCB Port I/O request; exploitation requires executing code inside a guest VM on the host, not remote network delivery.\nAC:L - A guest can reliably set GHCB exit_info_1 size to 0 (or count to 0) and issue string Port I/O via VMGEXIT without races or special host state; success does not depend on conditions outside attacker control.\nPR:N - The attacker needs no privileges on the host kernel\u2014only code execution inside an SEV-ES guest VM, which is the normal capability of a cloud confidential-VM tenant with no elevated host access.\nUI:N - Exploitation is fully attacker-driven from guest code via VMGEXIT; no host administrator or other user action is required.\nS:C - The vulnerable component is the host KVM hypervisor, but exploitation is initiated from a guest VM and impacts host kernel integrity/availability, crossing the guest/host security boundary.\nC:H - Allowing zero-length scratch setup sets ghcb_sa_len to 0, enabling unsigned length underflow in scratch-area size arithmetic; combined with ZERO_SIZE_PTR from kvzalloc(0), this is a memory-safety defect class that can yield out-of-bounds read primitives.\nI:H - Zero-length scratch configuration corrupts length tracking used by subsequent GHCB scratch handling, creating integer-underflow conditions that can lead to out-of-bounds writes; the divide-by-zero path also demonstrates uncontrolled host kernel failure from guest input.\nA:H - A malicious guest can reliably panic the host kernel via divide-by-zero in kvm_sev_es_string_io() when size is 0 and count is non-zero, causing complete loss of hypervisor availability for all co-hosted workloads."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:27.732Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3b6035bc6bff20e89752ce4358bc4c9a9d5883f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/2254972d4d69e279ba4e87bf0968eb08ad0d3c92"
        },
        {
          "url": "https://git.kernel.org/stable/c/c30cde934c7813b4e3069765dac64ce3d31e34f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/3988bd2723de407ae90fa7a6f6029b4e60238c58"
        }
      ],
      "title": "KVM: SEV: Ignore Port I/O requests of length \u00270\u0027",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63940",
    "datePublished": "2026-07-19T14:55:36.408Z",
    "dateReserved": "2026-07-19T07:54:57.022Z",
    "dateUpdated": "2026-08-05T12:37:27.732Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.