SB20260720293 - Heap-based buffer overflow in Linux kernel kvm svm

Description

This security bulletin contains information about 1 vulnerability.

1) Heap-based buffer overflow (CVE-ID: CVE-2026-63939)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the KVM SEV GHCB scratch area handling in arch/x86/kvm/svm/sev.c when processing PSC requests with a guest-provided scratch area pointer. A local user can provide a crafted scratch area pointer and length values to cause a denial of service.

The issue occurs when the scratch area is located in the GHCB shared buffer, where only the minimum header length was tracked instead of the full effective scratch area size.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5867d7e202e09f037cefe77f7af4413c7c0fa088
• https://git.kernel.org/stable/c/6644565527c4c5f507088b1c9ddf72de47790b68
• https://git.kernel.org/stable/c/6ca9400d36005ffdca25f80186bea781c7e1dc4c
• https://git.kernel.org/stable/c/9f0a9e780f02c02d025a190f1885e1d1d73b87bd