Heap-based buffer overflow in Linux kernel - CVE-2026-63939

Vulnerability identifier: #VU138709

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-63939

CWE-ID: CWE-122

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the KVM SEV GHCB scratch area handling in arch/x86/kvm/svm/sev.c when processing PSC requests with a guest-provided scratch area pointer. A local user can provide a crafted scratch area pointer and length values to cause a denial of service.

The issue occurs when the scratch area is located in the GHCB shared buffer, where only the minimum header length was tracked instead of the full effective scratch area size.

Linux kernel
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Live Patching
Ubuntu
kernel-livepatch-6_4_0-150700_7_67-rt-debuginfo
kernel-livepatch-SLE15-SP7-RT_Update_18-debugsource
kernel-livepatch-6_4_0-150700_7_67-rt
kernel-livepatch-SLE15-SP7-RT_Update_17-debugsource
kernel-livepatch-6_4_0-150700_7_62-rt
kernel-livepatch-6_4_0-150700_7_62-rt-debuginfo
kernel-livepatch-SLE15-SP7-RT_Update_16-debugsource
kernel-livepatch-6_4_0-150700_7_59-rt
kernel-livepatch-6_4_0-150700_7_54-rt-debuginfo
kernel-livepatch-SLE15-SP7-RT_Update_15-debugsource
kernel-livepatch-6_4_0-150700_7_59-rt-debuginfo
kernel-livepatch-6_4_0-150700_7_54-rt
kernel-livepatch-6_4_0-150700_7_51-rt
kernel-livepatch-6_4_0-150700_7_51-rt-debuginfo
kernel-livepatch-SLE15-SP7-RT_Update_14-debugsource
kernel-livepatch-SLE15-SP7-RT_Update_13-debugsource
kernel-livepatch-6_4_0-150700_7_44-rt-debuginfo
kernel-livepatch-6_4_0-150700_7_44-rt
kernel-livepatch-6_4_0-150700_7_40-rt
kernel-livepatch-SLE15-SP7-RT_Update_12-debugsource
kernel-livepatch-6_4_0-150700_7_40-rt-debuginfo
kernel-livepatch-SLE15-SP7-RT_Update_11-debugsource
kernel-livepatch-6_4_0-150700_7_37-rt-debuginfo
kernel-livepatch-SLE15-SP7-RT_Update_10-debugsource
kernel-livepatch-6_4_0-150700_7_34-rt
kernel-livepatch-6_4_0-150700_7_34-rt-debuginfo
kernel-livepatch-6_4_0-150700_7_37-rt
kernel-livepatch-SLE15-SP7-RT_Update_9-debugsource
kernel-livepatch-6_4_0-150700_7_31-rt
kernel-livepatch-6_4_0-150700_7_31-rt-debuginfo
kernel-livepatch-6_4_0-150700_7_25-rt-debuginfo
kernel-livepatch-6_4_0-150700_7_28-rt-debuginfo
kernel-livepatch-6_4_0-150700_7_25-rt
kernel-livepatch-6_4_0-150700_7_28-rt
kernel-livepatch-SLE15-SP7-RT_Update_8-debugsource
kernel-livepatch-SLE15-SP7-RT_Update_7-debugsource
kernel-livepatch-SLE15-SP7-RT_Update_6-debugsource
kernel-livepatch-6_4_0-150700_7_22-rt
kernel-livepatch-6_4_0-150700_7_22-rt-debuginfo
kernel-livepatch-6_4_0-150700_7_19-rt-debuginfo
kernel-livepatch-SLE15-SP7-RT_Update_5-debugsource
kernel-livepatch-6_4_0-150700_7_19-rt
kernel-livepatch-6_4_0-150700_7_16-rt
kernel-livepatch-6_4_0-150700_7_16-rt-debuginfo
kernel-livepatch-SLE15-SP7-RT_Update_4-debugsource
linux-ibm (Ubuntu package)
linux-azure (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-livepatch-6_4_0-150700_7_67-rt-debuginfo - update to 4-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_18-debugsource - update to 4-150700.2.1
kernel-livepatch-6_4_0-150700_7_67-rt - update to 4-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_17-debugsource - update to 6-150700.2.1
kernel-livepatch-6_4_0-150700_7_62-rt - update to 6-150700.2.1
kernel-livepatch-6_4_0-150700_7_62-rt-debuginfo - update to 6-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_16-debugsource - update to 7-150700.2.1
kernel-livepatch-6_4_0-150700_7_59-rt - update to 7-150700.2.1
kernel-livepatch-6_4_0-150700_7_54-rt-debuginfo - update to 7-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_15-debugsource - update to 7-150700.2.1
kernel-livepatch-6_4_0-150700_7_59-rt-debuginfo - update to 7-150700.2.1
kernel-livepatch-6_4_0-150700_7_54-rt - update to 7-150700.2.1
kernel-livepatch-6_4_0-150700_7_51-rt - update to 8-150700.2.1
kernel-livepatch-6_4_0-150700_7_51-rt-debuginfo - update to 8-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_14-debugsource - update to 8-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_13-debugsource - update to 9-150700.2.1
kernel-livepatch-6_4_0-150700_7_44-rt-debuginfo - update to 9-150700.2.1
kernel-livepatch-6_4_0-150700_7_44-rt - update to 9-150700.2.1
kernel-livepatch-6_4_0-150700_7_40-rt - update to 10-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_12-debugsource - update to 10-150700.2.1
kernel-livepatch-6_4_0-150700_7_40-rt-debuginfo - update to 10-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_11-debugsource - update to 11-150700.2.1
kernel-livepatch-6_4_0-150700_7_37-rt-debuginfo - update to 11-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_10-debugsource - update to 11-150700.2.1
kernel-livepatch-6_4_0-150700_7_34-rt - update to 11-150700.2.1
kernel-livepatch-6_4_0-150700_7_34-rt-debuginfo - update to 11-150700.2.1
kernel-livepatch-6_4_0-150700_7_37-rt - update to 11-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_9-debugsource - update to 13-150700.2.1
kernel-livepatch-6_4_0-150700_7_31-rt - update to 13-150700.2.1
kernel-livepatch-6_4_0-150700_7_31-rt-debuginfo - update to 13-150700.2.1
kernel-livepatch-6_4_0-150700_7_25-rt-debuginfo - update to 14-150700.2.1
kernel-livepatch-6_4_0-150700_7_28-rt-debuginfo - update to 14-150700.2.1
kernel-livepatch-6_4_0-150700_7_25-rt - update to 14-150700.2.1
kernel-livepatch-6_4_0-150700_7_28-rt - update to 14-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_8-debugsource - update to 14-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_7-debugsource - update to 14-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_6-debugsource - update to 15-150700.2.1
kernel-livepatch-6_4_0-150700_7_22-rt - update to 15-150700.2.1
kernel-livepatch-6_4_0-150700_7_22-rt-debuginfo - update to 15-150700.2.1
kernel-livepatch-6_4_0-150700_7_19-rt-debuginfo - update to 16-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_5-debugsource - update to 16-150700.2.1
kernel-livepatch-6_4_0-150700_7_19-rt - update to 16-150700.2.1
kernel-livepatch-6_4_0-150700_7_16-rt - update to 19-150700.2.1
kernel-livepatch-6_4_0-150700_7_16-rt-debuginfo - update to 19-150700.2.1
kernel-livepatch-SLE15-SP7-RT_Update_4-debugsource - update to 19-150700.2.1
linux-ibm (Ubuntu package) - addressed in versions 7.0.0-1008.8, 7.0.0-1010.10
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1010.10
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-azure-7.0 (Ubuntu package) - update to 7.0.0-1014.14~24.04.1
linux-nvidia (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1016.16
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

• https://git.kernel.org/stable/c/5867d7e202e09f037cefe77f7af4413c7c0fa088
• https://git.kernel.org/stable/c/6644565527c4c5f507088b1c9ddf72de47790b68
• https://git.kernel.org/stable/c/6ca9400d36005ffdca25f80186bea781c7e1dc4c
• https://git.kernel.org/stable/c/9f0a9e780f02c02d025a190f1885e1d1d73b87bd

• Heap-based buffer overflow in Linux kernel kvm svm
• Ubuntu update for linux-ibm
• Ubuntu update for linux-azure
• Ubuntu update for linux-aws
• Ubuntu update for linux-nvidia-bos
• Ubuntu update for linux-nvidia
• Ubuntu update for linux-gcp-7.0
• Ubuntu update for linux-oracle-7.0
• Ubuntu update for linux-azure-7.0
• SUSE update for the Linux Kernel RT (Live Patch 10 for SUSE Linux Enterprise 15 SP7)
• SUSE update for the Linux Kernel RT (Live Patch 18 for SUSE Linux Enterprise 15 SP7)
• SUSE update for the Linux Kernel RT (Live Patch 16 for SUSE Linux Enterprise 15 SP7)