Skip to main content

Linux Kernel CVE-2026-63794

| EUVDEUVD-2026-45460 HIGH
Out-of-bounds Write (CWE-787)
2026-07-19 Linux GHSA-8vm9-66j5-xm27
Buffer Overflow Linux Google Memory Corruption
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Exploitation needs local access and privileges to issue SEV VM ioctls (PR:L, AV:L), the trigger is attacker-controlled (AC:L), and kernel slab corruption yields high C/I/A within the host.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 30, 2026 - 17:54 vuln.today
CVSS changed
Jul 30, 2026 - 17:52 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 nvd
HIGH 7.8
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path

In sev_dbg_crypt(), the per-iteration transfer length is bounded by the source page offset (PAGE_SIZE - s_off) but not by the destination page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt path (__sev_dbg_encrypt_user) performs a read-modify-write using a single-page intermediate buffer (dst_tpage):

  1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off & 15), 16)

before issuing the PSP command. If len + (d_off & 15) > PAGE_SIZE, the PSP writes beyond the end of the 4096-byte dst_tpage allocation.

  1. The subsequent memcpy()/copy_from_user() into

page_address(dst_tpage) + (d_off & 15) of 'len' bytes overflows by up to 15 bytes under the same condition.

Trigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE - the PSP is instructed to write round_up(4097, 16) = 4112 bytes to a 4096-byte buffer.

Fix by also bounding len by (PAGE_SIZE - d_off), the same check that sev_send_update_data() already performs for its single-page guest region.

============== BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd] Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214

CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY Tainted: [U]=USER, [W]=WARN Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025 Call Trace: <TASK> dump_stack_lvl+0x54/0x70 print_report+0xbc/0x260 kasan_report+0xa2/0xd0 kasan_check_range+0x25f/0x2c0 __asan_memcpy+0x40/0x70 sev_dbg_crypt+0x993/0xd10 [kvm_amd] sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd] kvm_vm_ioctl+0x65d/0x6d0 [kvm] __se_sys_ioctl+0xb2/0x100 do_syscall_64+0xe8/0x870 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK>

The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb memcg:ff11000112827d82 flags: 0x1400000000000000(node=1|zone=1) raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000 raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82 page dumped because: kasan: bad access detected

Memory state around the buggy address: ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ============== Disabling lock debugging due to kernel taint

[sean: add sample KASAN splat, Fixes, and stable@]

AnalysisAI

Out-of-bounds heap write in the AMD SEV debug-encrypt path (sev_dbg_crypt/__sev_dbg_encrypt_user) of the Linux kernel's KVM/SVM code (kvm_amd) lets a local, privileged VMM process corrupt kernel slab memory by up to 15 bytes past a single-page buffer. The per-iteration transfer length is bounded by the source page offset but not the destination page offset, so when d_off > s_off the PSP command and a following memcpy()/copy_from_user() spill beyond the 4096-byte dst_tpage allocation. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but a KASAN slab-use-after-free splat is included in the report, confirming reliable reproducibility.

Technical ContextAI

The flaw lives in AMD Secure Encrypted Virtualization (SEV) debugging support inside the kvm_amd module, specifically the KVM_SEV_DBG_ENCRYPT operation reached via the SEV memory-encryption ioctl (sev_mem_enc_ioctl → sev_dbg_crypt). SEV lets the KVM host issue Platform Security Processor (PSP) commands to read/modify encrypted guest memory for debugging. The encrypt path performs a read-modify-write through a single-page intermediate buffer (dst_tpage): __sev_dbg_decrypt() rounds the length up to round_up(len + (d_off & 15), 16) before the PSP write, and the code then copies 'len' bytes to page_address(dst_tpage) + (d_off & 15). Because the loop clamps the chunk to PAGE_SIZE - s_off (source) but omits the symmetric PAGE_SIZE - d_off (destination) bound present in sev_send_update_data(), both the PSP write and the memcpy can exceed the 4KB page. This is a classic CWE-787 out-of-bounds write / heap buffer overflow. Affected code is present since roughly the 4.16 era of SEV debug support and spans all current stable branches per the CPE 'linux:linux' entries.

RemediationAI

Apply the kernel update for your branch: upgrade to Linux 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 7.1.3, or mainline 7.2-rc1 or later, which add the missing len bound of (PAGE_SIZE - d_off) in sev_dbg_crypt() (fix commits at https://git.kernel.org/stable/c/f701ae476cb92a3a3d8844bb39bb63b4512684c8 and the other stable commits listed in the CVE). Distribution users should install the vendor kernel that references CVE-2026-63794. If immediate patching is not possible, compensating controls are: restrict access to /dev/kvm and SEV VM management to trusted host processes only, and where feasible avoid or disable the SEV debug (KVM_SEV_DBG_ENCRYPT/DECRYPT) capability for untrusted guests - trade-off: this breaks legitimate SEV guest debugging/live-migration tooling that relies on the debug API. Because the vector is local and privilege-gated, tightening who can create and manage SEV guests materially reduces exposure. Consult the NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-63794) for branch-to-fix mapping.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

CVE-2026-63794 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy