CVE-2026-53360-POC

CVE-2026-53360: KVM SEV-SNP PSC ヒープ領域外アクセス KVMのSEV-SNP Page State Change（PSC）処理におけるヒープ領域外読み取りおよび書き込みの概念実証です。悪意のあるSEV-SNPゲストがホストカーネルにPSCエントリ配列をスラブ割り当ての末尾まで走査させます。これにより、隣接する kmalloc-cg-32 オブジェクトのレイアウトが漏洩し、制御された小さな値がそれらに書き込まれます。ゲストはこれを好きなだけ繰り返すことができます。 Full writeup:...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Requires the use of a scratch area if GHCB v2+ is in use According to the GHCB specification, when using GHCB v2+, it is required that the software scratch area resides in the GHCB’s shared buffer. Note that features li...

CVE-2026-63938

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM Secure Encrypted Virtualization SEV feature. When processing Page State Change PSC requests, the system does not properly validate the PSC buffer against the effective size of the scratch area. This can occur if a guest...

CVE-2026-63939

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM with Secure Encrypted Virtualization SEV support. This vulnerability arises from an incorrect calculation of the maximum length for the in-Guest-Host Communication Block GHCB scratch area. When processing Page State Change PS...

CVE-2026-63937

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM with Secure Encrypted Virtualization SEV. This time-of-check to time-of-use TOCTOU vulnerability exists when KVM processes the guest-accessible Page State Change PSC buffer. A misbehaving guest could exploit this timing issue...

SUSE CVE-2026-63937

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READONCE when reading entries/indices from PSC buffer Use READONCE when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READONCE/WRITEONCE...

SUSE CVE-2026-63938

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change PSC requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximu...

Linux Distros Unpatched Vulnerability : CVE-2026-63937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READONCE when reading entries/indices from PSC buffer Use READONCE when readin...

CVE-2026-63938 KVM: SEV: Check PSC request indices against the actual size of the buffer

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change PSC requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximu...

CVE-2026-63938

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change PSC requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximu...

CVE-2026-63938 KVM: SEV: Check PSC request indices against the actual size of the buffer

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change PSC requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximu...

EUVD-2026-45711

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change PSC requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximu...

CVE-2026-63938

The vulnerability CVE-2026-63938 affects the Linux kernel KVM SEV path, specifically PSC processing. The issue arises when validating PSC requests: the PSC buffer must be checked against the effective size of the scratch area, which may be smaller than the maximum if a guest supplies a pointer no...

EUVD-2026-45710

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READONCE when reading entries/indices from PSC buffer Use READONCE when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READONCE/WRITEONCE...

CVE-2026-63937 KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READONCE when reading entries/indices from PSC buffer Use READONCE when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READONCE/WRITEONCE...

CVE-2026-63937 KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READONCE when reading entries/indices from PSC buffer Use READONCE when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READONCE/WRITEONCE...

CVE-2026-63937

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READONCE when reading entries/indices from PSC buffer Use READONCE when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READONCE/WRITEONCE...

CVE-2026-57242 Foxit PDF Editor/Reader Page Use-After-Free Vulnerability

The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management and null value validation; when the page state changes, the application continuously dereferences invalid objects, eventually leading to a crash...

CVE-2026-53360

The CVE-2026-53360 entry concerns a Linux kernel KVM/SEV issue: if GHCB v2+ is used, in-GHCB scratch area must reside in the shared buffer. The root cause is a bounds check flaw in snp_begin_psc() where idx_end is validated against VMGEXIT_PSC_MAX_COUNT (253) but not against the actual buffer siz...

CVE-2026-53360 KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB spec, when using GHCB v2+ require the software scratch area to reside in the GHCB's shared buffer. Note, things like Page State Change PSC requests rely...