CVE-2026-53360-POC

CVE-2026-53360: KVM SEV-SNP PSC heap out-of-bounds Proof of concept for a heap out-of-bounds read and write in KVM's SEV-SNP Page State Change PSC handling. A malicious SEV-SNP guest makes the host kernel walk a PSC entry array off the end of its slab allocation. That leaks the layout of...

igvm

igvm This project is the home of the Independent Guest Virtual Machine IGVM file format. The format specification can be found in the igvmdefs crate, with a Rust implementation of the binary format in the igvm crate. The IGVM file format is designed to encapsulate all information required to laun...

CVE-2026-99258

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...

UBUNTU-CVE-2026-99258

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...

CVE-2026-99258 x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...

EUVD-2026-115769

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...

CVE-2026-99258

The Linux kernel contains a vulnerability in the x86/hyperv architecture specifically regarding the hv_apicid_to_vp_index() function. The issue arises because the function uses per-cpu hypercall input and output pages; however, in SEV-SNP CoCo VMs without a paravisor, the output page is not alloc...

PT-2026-136094

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hv apicid to vp index hv apicid to vp index currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP...

CVE-2025-0029

Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writes, potentially resulting in a loss of SEV-SNP guest memory integrity...

Linux Distros Unpatched Vulnerability : CVE-2025-0029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writes, potentially...

cve-2023-31355-poc

SEV Firmware Vulnerability This repo contains an exploit for a vulnerability in the SEV firmware. The exploit allows decrypting arbitrary memory of an SEV-SNP guest after it's been decommissioned. Tested on version 1.55.16 latest as of time of writing. Root Cause snpreclaimbuffer unconditionally...

POC_CVE-2025-29943_Write-what-where-Condition

StackWarp: PoC for CVE-2025-29943 Proof of concept for the StackWarp hardware vulnerability CVE-2025-29943 in AMD processors. This flaw allows an attacker with administrator privileges on a host hypervisor to manipulate the CPU pipeline configuration to corrupt the stack pointer within a SEV-SNP...

cve-2023-46813-poc

CVE-2023-46813 PoC 1. Apply the patches in the host-patches folder to the Linux host and QEMU. 2. Start an SEV-SNP VM. 3. Run the code in this repo and wait for the message "waiting for the hypervisor to change memory to MMIO". 4. Spam the attack command in QEMU several times. 5. Once the exploit...

cve-2024-21978-poc

SEV Firmware Vulnerability This repo contains an exploit for a vulnerability in the SEV firmware. The exploit allows decrypting arbitrary memory of a running SEV-SNP guest. Tested on version 1.55.16 latest as of the time of writing. Root Cause The nvpaddr field of the SEVINITEX command can be use...

cve-2023-20573-poc

PoC Usage This repo contains a VMM that boots an SEV-SNP guest with a custom kernel. The VMM and kernel are a stripped-down version of a project of mine. A modified Linux kernel is required to run on the host: https://github.com/Freax13/linux/tree/for-amd. The Proof of Concept can be run like thi...

cve-2023-31346-poc

Firmware Memory Leak The code here aims to demonstrate the memory leaks in guest messages headers and the CPUID request guest message. Prerequisites Install rustup. Install a Linux kernel with SEV-SNP host support. I used a kernel with my a few of own patches...

cvmimage

Tinfoil Confidential VM Tinfoil CVM is a confidential virtual machine for secure inference and custom compute workloads on AMD SEV-SNP and Intel TDX. Every byte of the final image is explicitly declared and derived from pinned inputs, the hermetic build is byte-for-byte reproducible, and anyone c...

CVE-2026-90040

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component, specifically affecting Secure Encrypted Virtualization-Secure Nested Paging SEV-SNP virtual machines. When a guest memory page backing a Virtual Machine Save Area VMSA is invalidated, KVM may fail to properly free...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel before version 6.9, a trusted-to-non-trusted hypervisor can inject Virtual Interrupt 29 VC at any point in time and can trigger its handler. This affects AMD SEV-SNP and AMD SEV-ES...

Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-8917-1)

"The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8917-1 advisory. It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local...