Out-of-bounds write in Linux kernel - CVE-2026-52959

Vulnerability identifier: #VU135413

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-52959

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to improper handling of a host-controlled allocation size in get_ext_report() in the sev-guest driver when processing an extended guest request. A local user can provide a crafted length value through the host response to cause memory corruption.

The issue occurs in the cleanup path after the host reports an invalid buffer length and returns an expected certificate buffer size.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-azure (Ubuntu package)
linux-aws (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - addressed in versions 7.0.0-28.28, 7.0.0-28.28.1, 7.0.0-1003.4, 7.0.0-1008.8
linux-ibm (Ubuntu package) - addressed in versions 7.0.0-1008.8, 7.0.0-1010.10
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1009.9
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1010.10
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15
linux-nvidia (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1016.16~24.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

• https://git.kernel.org/stable/c/23e6a1ca04ae44806439a5a446e62e4d42e80bb4
• https://git.kernel.org/stable/c/3f6fb0211b39aaa1b841260681dd02ca6b693ed5
• https://git.kernel.org/stable/c/9e48b4f813d2c3db75d522aa82ab705ce04b7e2d

• Out-of-bounds write in Linux kernel coco sev-guest driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux
• Ubuntu update for linux-ibm
• Ubuntu update for linux-azure
• Ubuntu update for linux-aws
• Ubuntu update for linux-nvidia-bos
• Ubuntu update for linux-nvidia