What is the CVSS score of CVE-2026-63937?

CVE-2026-63937 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63937?

A high-severity isolation flaw in Linux kernel AMD Secure Encrypted Virtualization (CVSS 8.8) allows malicious guest virtual machines to corrupt host kernel state and memory, violating the security…. A patch is available.

How to fix or mitigate CVE-2026-63937?

Within 24 hours, conduct inventory of all KVM hypervisors running Linux kernels with AMD SEV capability enabled; document kernel versions, affected workload counts, and business criticality of each system. Within 7 days, implement interim compensating controls: restrict guest VM provisioning to verified administrators with documented approval, disable AMD SEV for non-critical workloads if operationally feasible, monitor kernel audit logs for guest memory access anomalies, and configure alerting for page state change request irregularities; subscribe to Linux Kernel Security mailing lists and AMD security advisories for patch release notifications. Within 30 days, establish and validate a kernel patch deployment plan ready for execution; coordinate with infrastructure and scheduling teams to stage patches in non-production AMD SEV environments, test for workload compatibility, and plan rollout sequencing with required system reboots for production systems once patched kernel versions are released by the Linux kernel maintainers.

Linux Kernel CVE-2026-63937

EUVD-2026-45710 HIGH

2026-07-19 Linux

GHSA-vv26-frjx-jxxh

Information Disclosure Linux

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Attacker is a low-privileged guest (PR:L, AV:L), success needs winning a timing race (AC:H); scope crosses to host (S:C) with likely info disclosure high but limited integrity/availability impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:24 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jul 19, 2026 - 14:55 cve.org

HIGH 8.8

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer

Use READ_ONCE() when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs.

Don't bother with READ_ONCE()/WRITE_ONCE() for cases where KVM is writing (and not consuming the result!), as the guest isn't supposed to touch the buffer while it's being processed. I.e. using READ_ONCE() is all about protecting against misbehaving guests.

AnalysisAI

Time-of-check-to-time-of-use race condition in the Linux kernel's KVM AMD SEV code allows a malicious or misbehaving encrypted guest to corrupt the host's processing of Page State Change (PSC) requests by mutating the guest-accessible PSC buffer while KVM reads entries and indices from it. Because KVM read the buffer without READ_ONCE(), the compiler could reload values mid-processing, enabling a TOCTOU exploit path with a CVSS-rated scope-changed impact affecting the host beyond the guest. No public exploit has been identified at time of analysis, and the EPSS score is low (0.20%); the fix hardens the reads with READ_ONCE() to make the guest's writes irrelevant to already-validated values.

Technical ContextAI

The affected component is AMD SEV/SEV-ES/SEV-SNP support inside KVM (arch/x86/kvm/svm), specifically the handling of the Page State Change buffer used by an encrypted guest to request transitions between private and shared page states. This buffer is shared and guest-accessible, so its contents can change asynchronously relative to host processing. The root cause is a classic TOCTOU / race condition (CWE-367-class, though the record lists CWE as N/A): KVM validated entries and indices, then re-read them from the same guest-controlled buffer without an atomic/volatile access, allowing the compiler to reload the value between the check and the use. The fix applies READ_ONCE() on the consumer side while intentionally leaving KVM's own writes un-annotated, since the guest is not supposed to touch the buffer during processing and the protection is solely against a misbehaving guest.

RemediationAI

Upstream fix available (PR/commit); released patched version confirmed in stable trees - update to a kernel containing the fix, specifically 6.12.93, 6.18.35, or later stable point releases carrying commits bd232801ef1d1fd985d2d4ca3cd1d888303ca86f / b1dfaa6f7a957726a6800135be3659fbe4bbf2a4 / edbbe88f83b524434974e84808d3093199d67c24 / c8cc238093ca6c99267032f6cfe78f59389f3157 (see https://git.kernel.org/stable/c/bd232801ef1d1fd985d2d4ca3cd1d888303ca86f and the companion commits). Apply your distribution's corresponding kernel update once published. As a compensating control where patching is delayed, do not run untrusted AMD SEV/SEV-ES/SEV-SNP guests on affected hosts, or disable SEV guest provisioning (kvm_amd sev=0) - the trade-off is loss of confidential-computing/memory-encryption capability for tenants. Restricting who can launch encrypted guests to trusted operators also reduces exposure, since the attack requires control of a running guest.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63937 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63937

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code