What is the CVSS score of CVE-2026-63940?

CVE-2026-63940 has a contested CVSS base score of 9.3 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-63940?

A critical vulnerability in Linux servers with AMD confidential computing support (CVE-2026-63940) could allow compromised guest workloads to trigger hypervisor errors or resource exhaustion.. A patch is available.

How to fix or mitigate CVE-2026-63940?

Within 24 hours, identify all Linux hypervisors with AMD KVM SEV/SEV-ES enabled and assess exposure based on guest trust model and workload sensitivity. Within 7 days, acquire and test the upstream Linux kernel security patch addressing zero-length Port I/O handling from your kernel provider (RHEL, Ubuntu, or upstream sources), staging it in a non-production environment first. Within 30 days, apply the patched kernel across all affected production hypervisors, coordinate guest validation testing, and document baseline security posture restoration.

Linux Kernel CVE-2026-63940

EUVD-2026-45713 CRITICAL

2026-07-19 Linux

GHSA-jx39-q92m-wf39

Information Disclosure Linux

Critical

Disputed · 9.3 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

4.2 MEDIUM

Requires a malicious SEV guest (PR:L, AV:L) and winning an underflow race (AC:H); guest-to-host boundary gives S:C, but the hardening fix implies limited real impact (C:L/A:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:26 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.3 (CRITICAL)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

CRITICAL 9.3

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Ignore Port I/O requests of length '0'

Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.

AnalysisAI

Improper handling of zero-length Port I/O (PIO) requests in the Linux kernel's KVM AMD SEV/SEV-ES support allows a malicious confidential-computing guest to reach a length-underflow path when the hypervisor sets up the GHCB software scratch area. No public exploit has been identified at time of analysis and it is not on CISA KEV, though a vendor (upstream) patch is available. Despite a headline CVSS of 9.3, EPSS is only 0.20% (10th percentile), and the fix itself is a defensive hardening that ignores len/count '0' PIO to prevent length underflow.

Technical ContextAI

The affected component is KVM's AMD Secure Encrypted Virtualization (SEV/SEV-ES) code path that services guest VMGEXIT/GHCB requests, specifically the emulation of Port I/O (IN/OUT string) operations backed by the GHCB 'software scratch area'. When a guest issues a PIO request, the host computes a data length from the port width multiplied by the repeat count; a request with length or count of '0' can cause the scratch-area setup and downstream arithmetic to underflow the length value. The upstream fix explicitly ignores len'0'/count'0' requests so the scratch-area configuration cannot be driven with len==0 (and adds a WARN on that condition). No CWE was assigned in the input, but the root cause class is an integer/length underflow leading to out-of-bounds access - consistent with the vendor 'Information Disclosure' tag. The affected code was introduced by commit 291bd20d5d88 (SEV-ES GHCB support), so only kernels containing that SEV-ES scratch-area logic are in scope.

RemediationAI

Apply the vendor-released patch by upgrading to a fixed stable kernel: 6.12.95, 6.18.35, 7.0.12, or mainline 7.1 (or later), matching your maintained series - cross-reference the exact stable commits at https://git.kernel.org/stable/c/3988bd2723de407ae90fa7a6f6029b4e60238c58 and the companion commits, and rebuild/redeploy the affected hosts. If immediate patching is not possible, the practical compensating control is to disable AMD SEV/SEV-ES confidential-computing guests on affected hypervisors (do not launch SEV-encrypted VMs), which removes the vulnerable code path entirely at the cost of losing memory-encryption isolation for tenant workloads. Restricting who can start SEV guests to trusted operators reduces exposure to untrusted-tenant abuse but does not fix the bug. Because the affected surface is guest-to-host, standard host hardening (up-to-date microcode, minimizing untrusted multi-tenant SEV workloads) is a reasonable interim posture until the kernel update is rolled out.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63940 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63940

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code