Cloudanix VulnDB

CVE-2026-63937

High · 8.8

CVSS

8.8

EPSS

0.1%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A problem in the way virtual machine memory changes are tracked could let code running inside one virtual machine interfere with the main system that runs it.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing READ_ONCE() on guest-writable PSC buffer entries allows TOCTOU race where guest can modify indices or page state values after KVM reads them but before use, enabling inconsistent state processing.

Why it matters to the business

A compromised or malicious guest VM can corrupt hypervisor page state tracking, potentially leading to host memory corruption, privilege escalation to the hypervisor, or denial of service affecting multiple tenants on the same host.

How an attack unfolds

An attacker with code execution inside a SEV guest crafts concurrent writes to the PSC buffer while KVM is iterating it; without READ_ONCE the kernel may observe torn or stale values, causing incorrect page state transitions that the guest can leverage for further host memory access or crashes.

How to fix it

Apply the upstream Linux kernel patch that adds READ_ONCE() when consuming PSC buffer entries; rebuild and deploy updated kernel packages on all hosts running KVM with SEV support.

How to confirm the fix worked

Confirm the READ_ONCE() calls are present in the PSC buffer processing paths in arch/x86/kvm/svm/sev.c (or equivalent) after patching; recompile with the fix and verify no functional regression in SEV guest page state change operations.

Typical attack path

  1. Gain code execution inside an SEV-enabled guest VM
  2. Map and repeatedly write to the guest-visible PSC buffer while triggering KVM page state change hypercalls
  3. Observe or force inconsistent entry/index values due to lack of READ_ONCE
  4. Trigger hypervisor use of stale values to corrupt internal KVM state or host page tables
  5. Escalate to host memory read/write or crash

How to detect it

Search hypervisor logs and KVM tracepoints for unexpected or repeated PSC buffer processing errors, page state inconsistencies, or guest-induced hypervisor crashes around SEV VM execution; correlate with guest activity that manipulates page state change structures.

What your security team should do

  • Prioritize patching KVM/SEV hosts within the next maintenance window given the high CVSS and local guest-to-host impact
  • Review SEV guest isolation policies and consider disabling SEV on untrusted workloads until patched
  • Monitor upstream stable kernel releases for backports of this fix

The record

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Use READ_ONCE() when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READ_ONCE()/WRITE_ONCE() for cases where KVM is writing (and not consuming the result!), as the guest isn't supposed to touch the buffer while it's being processed. I.e. using READ_ONCE() is all about protecting against misbehaving guests.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities