Host-side buffer overflow in the Linux kernel's KVM AMD SEV/SEV-ES support (arch/x86/kvm/svm/sev.c GHCB handling) lets a malicious or compromised confidential guest corrupt host memory by abusing Page State Change (PSC) requests. KVM miscomputes the maximum length of the in-GHCB scratch area, treating the guest-supplied @len as the buffer's full size when for PSC it is only a minimum, allowing a guest to drive writes past the shared GHCB buffer. Rated CVSS 9.3 for a scope-changed guest-to-host escape; no public exploit is identified at time of analysis and EPSS is low (0.22%), but a vendor patch is available across multiple stable branches.
Improper handling of zero-length Port I/O (PIO) requests in the Linux kernel's KVM AMD SEV/SEV-ES support allows a malicious confidential-computing guest to reach a length-underflow path when the hypervisor sets up the GHCB software scratch area. No public exploit has been identified at time of analysis and it is not on CISA KEV, though a vendor (upstream) patch is available. Despite a headline CVSS of 9.3, EPSS is only 0.20% (10th percentile), and the fix itself is a defensive hardening that ignores len/count '0' PIO to prevent length underflow.
Out-of-bounds memory access in the Linux kernel's KVM AMD SEV-SNP subsystem allows a malicious or compromised confidential-computing guest to read or corrupt host hypervisor memory by supplying a Page State Change (PSC) request whose buffer pointer is not aligned to the start of the GHCB shared buffer. The flaw affects KVM hosts running SEV-SNP guests on kernels from 6.11 onward and carries a high CVSS of 9.3 (AV:L/S:C) reflecting a guest-to-host boundary crossing. EPSS is low (0.20%, 10th percentile), it is not on CISA KEV, and no public exploit has been identified at time of analysis; a vendor fix is available in the stable trees.
Kernel memory corruption in the Linux MANA (Microsoft Azure Network Adapter) driver lets a malicious or compromised hypervisor bypass a bounds check via a time-of-check/time-of-use double-fetch of hwc_msg_id from a shared DMA buffer. In a Confidential VM (SEV-SNP/TDX), DMA-coherent memory is unencrypted and host-visible, so the host can alter the message ID after mana_hwc_rx_event_handler() validates it but before mana_hwc_handle_resp() re-reads it for test_bit() and pointer arithmetic, driving an out-of-bounds access in guest kernel memory. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and it is not in CISA KEV.
Kernel memory corruption in the Linux arm_ffa (Arm Firmware Framework for A-profile) driver allows a local attacker to trigger a use-after-free by racing notifier unregistration against active notification delivery, affecting Arm systems running kernels from 6.15 up to the fixed 6.18.34/7.0.11 releases. Both the framework and non-framework notification handlers looked up a callback under notify_lock, dropped the lock, then dereferenced a notifier entry that a concurrent unregister could have already freed. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and it is not listed in CISA KEV.
Out-of-bounds array access in the Linux kernel's Microsoft Azure Network Adapter (mana) driver lets a malicious hypervisor corrupt guest kernel memory within Confidential VMs. In mana_hwc_rx_event_handler(), the rx_req_idx index is read from host-shared DMA-coherent memory (a WQE's sge->address) without a bounds check, so in SEV-SNP/TDX guests the untrusted host can steer the index to read/write past the reqs[] array. There is no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a defense-in-depth hardening fix for the confidential-computing threat model rather than an actively exploited flaw.
Out-of-bounds memory access in the Linux kernel's IP tunnel path-MTU discovery code (iptunnel_pmtud_check_icmp) affects IPv4 tunnel interfaces where the function may run on packets whose skb transport header is unset, causing an ~65535-byte offset read past the linear buffer. Remote attackers can trigger this by sending crafted ICMP traffic to a tunnel endpoint, potentially leaking adjacent kernel memory or crashing the host (denial of service). This is a supplier-reported (Linux stable) fix with no public exploit identified at time of analysis and a low EPSS score of 0.18%.
Out-of-bounds host memory access in the Linux kernel's arm64 KVM virtual ITS (vgic-its) subsystem allows a local user driving the VM migration/restore path to disclose kernel memory and crash the host. The flaw lets userspace restore an ITS Device Table Entry (DTE) whose Size field encodes more EventID bits than the virtual ITS supports; vgic_its_restore_dte() stores this out-of-range num_eventid_bits, which later produces an oversized scan_its_table() range. It carries a high CVSS (9.0) but a very low EPSS (0.18%), with no public exploit identified at time of analysis and no CISA KEV listing.