{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63938","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.022Z","datePublished":"2026-07-19T14:55:35.168Z","dateUpdated":"2026-08-05T12:37:25.558Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:37:25.558Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Check PSC request indices against the actual size of the buffer\n\nWhen processing Page State Change (PSC) requests, validate the PSC buffer\nagainst the effective size of the scratch area, which could be less than\nthe maximum size if the guest provided a pointer that isn't exactly at the\nstart of the GHCB shared buffer."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.3,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is reached when malicious code inside an SEV-SNP guest issues a Page State Change VMGEXIT (SVM_VMGEXIT_PSC) through the GHCB, causing a VM exit handled locally by KVM on the host.\nAC:L - The guest fully controls sw_scratch placement, PSC header indices, and entry contents; triggering the out-of-bounds access is deterministic and does not depend on races or conditions outside attacker control.\nPR:N - Exploitation requires only the ability to run code in an SEV-SNP guest (e.g., a cloud confidential-VM tenant), not host root, CAP_SYS_ADMIN, or other elevated host privileges.\nUI:N - No victim user action is required beyond the attacker operating inside their own guest; the malicious VMGEXIT is self-contained.\nS:C - The vulnerability crosses the guest/host security boundary: a guest VM can corrupt host kernel memory via out-of-bounds access during PSC processing, enabling VM escape.\nC:H - Out-of-bounds reads of guest_psc->entries[idx] via READ_ONCE() can read kernel memory beyond the effective scratch buffer, including data past the GHCB page mapping. Out-of-bounds writes in __snp_complete_one_psc() (guest_psc->entries[idx].cur_page) corrupt memory beyond the validated buffer, providing a memory corruption primitive exploitable for host code execution. Out-of-bounds reads of guest_psc->entries[idx] via READ_ONCE() can read kernel memory beyond the effective scratch buffer, including data past the GHCB page mapping.\nI:H - Out-of-bounds writes in __snp_complete_one_psc() (guest_psc->entries[idx].cur_page) corrupt memory beyond the validated buffer, providing a memory corruption primitive exploitable for host code execution.\nA:H - Out-of-bounds access on the GHCB mapping can cause host kernel oops, panic, or BUG when indices extend past the mapped page boundary."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kvm/svm/sev.c"],"versions":[{"version":"9b54e248d2644be71cb394eb85f31ad99e023a05","lessThan":"5198f70c09a5f6e9e5f5a0a2c6b388f24294b176","status":"affected","versionType":"git"},{"version":"9b54e248d2644be71cb394eb85f31ad99e023a05","lessThan":"75c8d1d7291268b479794fba5808971dc2f5eaf3","status":"affected","versionType":"git"},{"version":"9b54e248d2644be71cb394eb85f31ad99e023a05","lessThan":"505a3b94535583e4265360e2621734e355ef263d","status":"affected","versionType":"git"},{"version":"9b54e248d2644be71cb394eb85f31ad99e023a05","lessThan":"121d88de56bc5c0ba0ce2f6381af67f948a7e7c1","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kvm/svm/sev.c"],"versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","status":"unaffected","versionType":"semver"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/5198f70c09a5f6e9e5f5a0a2c6b388f24294b176"},{"url":"https://git.kernel.org/stable/c/75c8d1d7291268b479794fba5808971dc2f5eaf3"},{"url":"https://git.kernel.org/stable/c/505a3b94535583e4265360e2621734e355ef263d"},{"url":"https://git.kernel.org/stable/c/121d88de56bc5c0ba0ce2f6381af67f948a7e7c1"}],"title":"KVM: SEV: Check PSC request indices against the actual size of the buffer","x_generator":{"engine":"bippy-1.2.0"}}}}