CVE-2026-63938 (GCVE-0-2026-63938)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
Title
KVM: SEV: Check PSC request indices against the actual size of the buffer
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change (PSC) requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximum size if the guest provided a pointer that isn't exactly at the start of the GHCB shared buffer.
Severity
9.3 (Critical)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9b54e248d2644be71cb394eb85f31ad99e023a05 , < 5198f70c09a5f6e9e5f5a0a2c6b388f24294b176 (git)
Affected: 9b54e248d2644be71cb394eb85f31ad99e023a05 , < 75c8d1d7291268b479794fba5808971dc2f5eaf3 (git)
Affected: 9b54e248d2644be71cb394eb85f31ad99e023a05 , < 505a3b94535583e4265360e2621734e355ef263d (git)
Affected: 9b54e248d2644be71cb394eb85f31ad99e023a05 , < 121d88de56bc5c0ba0ce2f6381af67f948a7e7c1 (git)
Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5198f70c09a5f6e9e5f5a0a2c6b388f24294b176",
              "status": "affected",
              "version": "9b54e248d2644be71cb394eb85f31ad99e023a05",
              "versionType": "git"
            },
            {
              "lessThan": "75c8d1d7291268b479794fba5808971dc2f5eaf3",
              "status": "affected",
              "version": "9b54e248d2644be71cb394eb85f31ad99e023a05",
              "versionType": "git"
            },
            {
              "lessThan": "505a3b94535583e4265360e2621734e355ef263d",
              "status": "affected",
              "version": "9b54e248d2644be71cb394eb85f31ad99e023a05",
              "versionType": "git"
            },
            {
              "lessThan": "121d88de56bc5c0ba0ce2f6381af67f948a7e7c1",
              "status": "affected",
              "version": "9b54e248d2644be71cb394eb85f31ad99e023a05",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Check PSC request indices against the actual size of the buffer\n\nWhen processing Page State Change (PSC) requests, validate the PSC buffer\nagainst the effective size of the scratch area, which could be less than\nthe maximum size if the guest provided a pointer that isn\u0027t exactly at the\nstart of the GHCB shared buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached when malicious code inside an SEV-SNP guest issues a Page State Change VMGEXIT (SVM_VMGEXIT_PSC) through the GHCB, causing a VM exit handled locally by KVM on the host.\nAC:L - The guest fully controls sw_scratch placement, PSC header indices, and entry contents; triggering the out-of-bounds access is deterministic and does not depend on races or conditions outside attacker control.\nPR:N - Exploitation requires only the ability to run code in an SEV-SNP guest (e.g., a cloud confidential-VM tenant), not host root, CAP_SYS_ADMIN, or other elevated host privileges.\nUI:N - No victim user action is required beyond the attacker operating inside their own guest; the malicious VMGEXIT is self-contained.\nS:C - The vulnerability crosses the guest/host security boundary: a guest VM can corrupt host kernel memory via out-of-bounds access during PSC processing, enabling VM escape.\nC:H - Out-of-bounds reads of guest_psc-\u003eentries[idx] via READ_ONCE() can read kernel memory beyond the effective scratch buffer, including data past the GHCB page mapping. Out-of-bounds writes in __snp_complete_one_psc() (guest_psc-\u003eentries[idx].cur_page) corrupt memory beyond the validated buffer, providing a memory corruption primitive exploitable for host code execution. Out-of-bounds reads of guest_psc-\u003eentries[idx] via READ_ONCE() can read kernel memory beyond the effective scratch buffer, including data past the GHCB page mapping.\nI:H - Out-of-bounds writes in __snp_complete_one_psc() (guest_psc-\u003eentries[idx].cur_page) corrupt memory beyond the validated buffer, providing a memory corruption primitive exploitable for host code execution.\nA:H - Out-of-bounds access on the GHCB mapping can cause host kernel oops, panic, or BUG when indices extend past the mapped page boundary."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:25.558Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5198f70c09a5f6e9e5f5a0a2c6b388f24294b176"
        },
        {
          "url": "https://git.kernel.org/stable/c/75c8d1d7291268b479794fba5808971dc2f5eaf3"
        },
        {
          "url": "https://git.kernel.org/stable/c/505a3b94535583e4265360e2621734e355ef263d"
        },
        {
          "url": "https://git.kernel.org/stable/c/121d88de56bc5c0ba0ce2f6381af67f948a7e7c1"
        }
      ],
      "title": "KVM: SEV: Check PSC request indices against the actual size of the buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63938",
    "datePublished": "2026-07-19T14:55:35.168Z",
    "dateReserved": "2026-07-19T07:54:57.022Z",
    "dateUpdated": "2026-08-05T12:37:25.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63938",
      "date": "2026-08-11",
      "epss": "0.0018",
      "percentile": "0.07792"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63938\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:12.323\",\"lastModified\":\"2026-07-27T17:44:23.777\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: SEV: Check PSC request indices against the actual size of the buffer\\n\\nWhen processing Page State Change (PSC) requests, validate the PSC buffer\\nagainst the effective size of the scratch area, which could be less than\\nthe maximum size if the guest provided a pointer that isn\u0027t exactly at the\\nstart of the GHCB shared buffer.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/svm/sev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9b54e248d2644be71cb394eb85f31ad99e023a05\",\"lessThan\":\"5198f70c09a5f6e9e5f5a0a2c6b388f24294b176\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b54e248d2644be71cb394eb85f31ad99e023a05\",\"lessThan\":\"75c8d1d7291268b479794fba5808971dc2f5eaf3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b54e248d2644be71cb394eb85f31ad99e023a05\",\"lessThan\":\"505a3b94535583e4265360e2621734e355ef263d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b54e248d2644be71cb394eb85f31ad99e023a05\",\"lessThan\":\"121d88de56bc5c0ba0ce2f6381af67f948a7e7c1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/svm/sev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.93\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.35\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/121d88de56bc5c0ba0ce2f6381af67f948a7e7c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/505a3b94535583e4265360e2621734e355ef263d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5198f70c09a5f6e9e5f5a0a2c6b388f24294b176\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/75c8d1d7291268b479794fba5808971dc2f5eaf3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:05:26+00:00",
      "cve": "CVE-2026-63938",
      "id": "CVE-2026-63938",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: SEV: Check PSC request indices against the actual size of the buffer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63938.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-10T16:25:11Z",
      "cve": "CVE-2026-63938",
      "id": "CVE-2026-63938",
      "initial_release_date": "2026-07-21T13:03:09Z",
      "product_status:first_fixed": "98",
      "product_status:known_affected": "55",
      "product_status:known_not_affected": "229",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63938",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63938.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.