CVE-2026-63939

Critical · 9.3

CVSS

9.3

EPSS

0.2%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel handles certain encrypted virtual machine requests could let a compromised guest machine damage the main system that runs it.

Exploitation: Local Privilege
Attacker needs: Local User
Complexity: Low
Impact: Full Compromise
Component: OS kernel
Class: Memory Corruption
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Incorrect length calculation for the GHCB scratch area in KVM SEV when handling PSC requests allows the guest-provided pointer to exceed the shared buffer boundary, resulting in out-of-bounds writes during MMIO emulation and buffer handling.

Why it matters to the business

Local attackers on affected hypervisors can corrupt hypervisor memory, leading to guest escape, full host compromise, and potential loss of confidentiality, integrity, and availability for all virtual machines on the system; urgency is moderate given low EPSS and lack of known exploitation.

How an attack unfolds

An attacker controlling a SEV-enabled guest crafts a PSC request that supplies a minimum header length while positioning the scratch pointer near the end of the GHCB shared buffer; KVM uses the supplied minimum instead of the maximum feasible length, performing writes that overflow the buffer and corrupt adjacent hypervisor structures.

How to fix it

Apply the upstream KVM SEV fix that correctly computes the effective scratch area length from the guest pointer and shared buffer end; rebuild and deploy updated kernel packages containing the renamed min_len logic and boundary check.

How to confirm the fix worked

Confirm the patch is present by inspecting the KVM SEV PSC handler for the corrected length calculation using the end-of-buffer boundary; test with synthetic PSC requests that previously triggered overflow conditions and verify no out-of-bounds writes occur.

Typical attack path

Gain code execution or control inside a SEV guest VM
Trigger a PSC request via the GHCB interface with a pointer near the shared buffer end
Supply a length value that is treated as minimum rather than maximum
Cause KVM to write beyond the scratch area into adjacent memory
Leverage resulting corruption for privilege escalation or hypervisor code execution

How to detect it

Search hypervisor logs for unusual PSC request patterns or GHCB buffer handling errors; examine KVM tracepoints around SEV scratch area length calculations for values that exceed expected shared buffer bounds.

What your security team should do

Prioritize kernel updates on all SEV-enabled KVM hosts within standard change windows
Monitor upstream stable kernel releases for backports of the GHCB length fix
Review hypervisor configurations to ensure SEV guests are isolated where possible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible size given the start of the guest-provided pointer, and the end of the shared buffer. The code was "fine" when first introduced, as KVM doesn't consult the length of the buffer when emulating MMIO, because the passed in @len always specifies the *max* size required. But for PSC requests, the incoming @len is just the minimum length (to process the header), and KVM needs to know the full size of the scratch area to avoid buffer overflows (spoiler alert). Opportunistically rename @len => @min_len to better reflect its role.

Affected packages

Ecosystem	Package	Introduced	Fixed