CVE-2026-63939

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) with Secure Encrypted Virtualization (SEV) support. This vulnerability arises from an incorrect calculation of the maximum length for the in-Guest-Host Communication Block (GHCB) scratch area. When processing Page State Change (PSC) requests, KVM uses a minimum length instead of the full required size, which can lead to a buffer overflow. A malicious guest operating system could potentially exploit this to cause a denial of service or escalate privileges on the host system.

A buffer overflow flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) support for Secure Encrypted Virtualization (SEV). When processing a Page State Change (PSC) request from a guest, KVM calculated the length of the in-GHCB scratch area using the minimum length needed to process the request header instead of the maximum possible size bounded by the guest-provided pointer and the end of the GHCB shared buffer. A malicious or compromised guest operating system could exploit this flaw to overflow a buffer in the host kernel, causing a denial of service or potentially escalating privileges on the host. Red Hat rates this issue as IMPORTANT (CVSS 7.0); the upstream CVE.org severity of CRITICAL (CVSS 9.3) differs because Red Hat's scoring accounts for the high attack complexity and the privileges required, as an attacker must already control a guest virtual machine running on a host with SEV enabled. The kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10, and the kernel packages in Red Hat In-Vehicle OS 2, are affected. Red Hat Enterprise Linux 6, 7, and 8, and the RHEL 9.2 and 9.4 update streams, are not affected because the vulnerable code is not present in those releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.