SB20260720124 - Improper control of a resource through its lifetime in Linux kernel coco sev-guest driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64104)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of pages left in an unknown encryption state in drivers/virt/coco/sev-guest/sev-guest.c when handling extended report requests and memory encryption state transitions. A local user can trigger failures in set_memory_encrypted() or set_memory_decrypted() to cause a denial of service.

The issue affects pages that may remain in an unencrypted or otherwise unknown state and therefore cannot be safely returned for general reuse.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3d0cd0065deeb054b4b29236432e851806b7cc81
• https://git.kernel.org/stable/c/bee400ad4f4259c9c0758e4f1960a1eed6f6f9f0
• https://git.kernel.org/stable/c/fd948c3f96b18ff9ba7d3e8eae13d196593e1aaf