Skip to main content

Linux Kernel CVE-2026-52959

| EUVDEUVD-2026-38827 HIGH
2026-06-24 Linux GHSA-rj55-92m8-99mg
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Local guest trigger (PR:L) but corruption needs a malicious host to return a crafted mismatched length (AC:H); page-allocator corruption gives high integrity/availability impact, limited confidentiality.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.8 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:37 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:28 cve.org
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

virt: sev-guest: Do not use host-controlled page order in cleanup path

When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST), get_ext_report() allocates a buffer to retrieve a certificate blob from the host, keeping track of its size in report_req->certs_len.

However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating an invalid buffer size, as well as the expected length of such buffer. get_ext_report() subsequently updates report_req->certs_len with the host-controlled value, and cleans up the buffer by computing a page order from such value. This is incorrect, as the host-provided length may not match the page order of the original allocation, potentially resulting in corruption in the page allocator.

Fix this by using alloc_pages_exact() instead, and reusing @npages to compute the size passed to free_pages_exact(). For consistency, also use @npages to compute the size when allocating the pages, even though this last change has no functional effect.

AnalysisAI

Page allocator corruption in the Linux kernel's AMD SEV-SNP guest driver (virt/sev-guest) affects confidential-computing guests running kernels from 6.14 onward. When a guest issues an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST), an untrusted host can return SNP_GUEST_VMM_ERR_INVALID_LEN with a length that does not match the original allocation; the cleanup path then frees pages using a host-controlled page order, corrupting the guest's page allocator. CVSS is 7.8 (local, high C/I/A), but EPSS is just 0.11% (2nd percentile), and there is no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

The affected component is the SEV-SNP guest driver (drivers/virt/coco/sev-guest) used inside AMD Secure Encrypted Virtualization-Secure Nested Paging confidential VMs. In this threat model the hypervisor/host is explicitly untrusted. get_ext_report() allocates a buffer to receive a certificate blob from the host and tracks its size in report_req->certs_len. On the SNP_GUEST_VMM_ERR_INVALID_LEN path the host supplies the 'expected' length, the driver overwrites certs_len with that host-controlled value, then derives a page order from it to release the buffer. Because the freeing page order is computed from attacker-influenced data rather than the original allocation, the free does not match the alloc, corrupting kernel page-allocator metadata. The fix switches to alloc_pages_exact()/free_pages_exact() and uses the locally tracked @npages so allocation and free sizes always agree. CWE was not assigned by NVD, but the root cause is a memory-management mismatch (free of incorrect size / allocator metadata corruption, in the CWE-763/CWE-787 family).

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.18.33, 7.0.10, or 7.1 (or your distribution's backported equivalent) - which replaces the host-controlled page-order free with alloc_pages_exact()/free_pages_exact() so allocation and free sizes always match. The upstream commits are 3f6fb0211b39aaa1b841260681dd02ca6b693ed5, 9e48b4f813d2c3db75d522aa82ab705ce04b7e2d, and 23e6a1ca04ae44806439a5a446e62e4d42e80bb4 (git.kernel.org/stable/c/<hash>). If immediate patching is not possible, the only meaningful exposure is in AMD SEV-SNP confidential guests, so the practical compensating control is to avoid exposing such guests to an untrusted/compromised hypervisor and to restrict or avoid extended guest-request (certificate-fetch) workflows from untrusted hosts until patched; note the trade-off is loss of host-provided certificate retrieval functionality. Non-SEV-SNP systems do not exercise this path and need only routine kernel updates. See https://nvd.nist.gov/vuln/detail/CVE-2026-52959.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-52959 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy