CVE-2026-63937

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) with Secure Encrypted Virtualization (SEV). This time-of-check to time-of-use (TOCTOU) vulnerability exists when KVM processes the guest-accessible Page State Change (PSC) buffer. A misbehaving guest could exploit this timing issue by modifying the buffer after it has been checked but before it is used, potentially leading to an impact on the integrity of the virtualized environment.

A TOCTOU race exists in the KVM/SEV SNP Page State Change handling path because KVM reads guest accessible PSC header indices and PSC entries without READ_ONCE(). A malicious guest can modify the PSC buffer while the host is validating and consuming it, which can make KVM process inconsistent entry data or index values during page state change handling. For the CVSS the PR:L is used because the attacker needs the ability to execute code in a guest or otherwise control a guest PSC buffer, but does not need host administrative privileges. The issue is not directly network reachable and is a guest to host virtualization interface issue. Impact is at least host denial of service risk and in the paranoid interpretation may allow limited confidentiality or integrity impact through inconsistent page state processing, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.