What is the CVSS score of CVE-2026-63938?

CVE-2026-63938 has a contested CVSS base score of 9.3 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-63938?

CVE-2026-63938 is a critical out-of-bounds memory vulnerability in the Linux kernel's KVM AMD SEV-SNP subsystem affecting confidential-computing environments on kernel 6.11 and later.. A patch is available.

How to fix or mitigate CVE-2026-63938?

Within 24 hours, inventory all production servers running Linux kernel 6.11 or later with KVM and AMD SEV-SNP enabled, and assess exposure to untrusted guest workloads. Within 7 days, apply the available vendor-released patch from the Linux kernel stable trees to all affected systems and schedule controlled reboots. Within 30 days, validate that all SEV-SNP guests are executing on patched hosts, with priority on systems hosting customer or sensitive workloads, and document completion of patch deployment.

Linux Kernel CVE-2026-63938

EUVD-2026-45711 CRITICAL

2026-07-19 Linux

GHSA-q47x-vhx7-rrvj

Information Disclosure Linux

Critical

Disputed · 9.3 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.3 CRITICAL

Attacker acts from a controlled guest (AV:L, PR:N) and crosses into the host (S:C); low-complexity OOB access yields high confidentiality, integrity, and availability impact on the hypervisor.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:26 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.3 (CRITICAL)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

CRITICAL 9.3

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Check PSC request indices against the actual size of the buffer

When processing Page State Change (PSC) requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximum size if the guest provided a pointer that isn't exactly at the start of the GHCB shared buffer.

AnalysisAI

Out-of-bounds memory access in the Linux kernel's KVM AMD SEV-SNP subsystem allows a malicious or compromised confidential-computing guest to read or corrupt host hypervisor memory by supplying a Page State Change (PSC) request whose buffer pointer is not aligned to the start of the GHCB shared buffer. The flaw affects KVM hosts running SEV-SNP guests on kernels from 6.11 onward and carries a high CVSS of 9.3 (AV:L/S:C) reflecting a guest-to-host boundary crossing. EPSS is low (0.20%, 10th percentile), it is not on CISA KEV, and no public exploit has been identified at time of analysis; a vendor fix is available in the stable trees.

Technical ContextAI

The vulnerability lives in KVM's handling of the AMD Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) Guest-Hypervisor Communication Block (GHCB). When a guest issues a Page State Change hypercall, it points KVM at a PSC buffer located within the GHCB shared scratch area. The pre-patch code validated PSC request indices against the maximum possible scratch-area size rather than the effective size, which shrinks when the guest supplies a pointer that does not begin exactly at the start of the shared buffer. This is an improper array-index/bounds-validation weakness (CWE-129/CWE-125 class; the CVE record lists CWE as N/A), letting request indices reference memory beyond the actual buffer. The affected component is the KVM hypervisor (cpe:2.3:a:linux:linux) processing attacker-controlled GHCB data on AMD EPYC platforms with SEV-SNP enabled.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.12.93, 6.18.35, 7.0.12, or 7.1 (or later) per the EUVD patch data - or apply the upstream stable commits at https://git.kernel.org/stable/c/505a3b94535583e4265360e2621734e355ef263d and its siblings (5198f70c09a5f6e9e5f5a0a2c6b388f24294b176, 75c8d1d7291268b479794fba5808971dc2f5eaf3, 121d88de56bc5c0ba0ce2f6381af67f948a7e7c1). Where immediate patching is not possible, the concrete compensating control is to not run untrusted SEV-SNP guests on the affected host, or to disable SEV-SNP guest support until patched; the trade-off is loss of confidential-computing capability for those workloads. Because the attacker must control a guest, restricting SEV-SNP tenancy to trusted workloads meaningfully reduces exposure in the interim.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63938 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63938

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code