CVE-2026-63939
Received Received - Intake

KVM SEV Buffer Length Miscalculation in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible size given the start of the guest-provided pointer, and the end of the shared buffer. The code was "fine" when first introduced, as KVM doesn't consult the length of the buffer when emulating MMIO, because the passed in @len always specifies the *max* size required. But for PSC requests, the incoming @len is just the minimum length (to process the header), and KVM needs to know the full size of the scratch area to avoid buffer overflows (spoiler alert). Opportunistically rename @len => @min_len to better reflect its role.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63939
EUVD
EUVD-2026-45712

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect calculation of the maximum length for the in-GHCB scratch area when it is located in the GHCB shared buffer. The issue arises because the code was designed assuming the length parameter always specifies the maximum size, but for certain requests, it only provides the minimum length. This can lead to buffer overflows when KVM needs the full size of the scratch area.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM SEV implementation and requires kernel-level inspection. Detection involves checking kernel version and configuration rather than network commands. Verify if your kernel version includes the fix by running uname -a and checking for patches addressing CVE-2026-63939. No direct network detection commands are applicable.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a buffer overflow in the Linux kernel, potentially leading to system crashes, data corruption, or unauthorized access to sensitive information. It primarily affects systems using KVM with SEV (Secure Encrypted Virtualization) enabled.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue in KVM's SEV implementation that could lead to buffer overflows during PSC requests, but no evidence suggests it impacts data protection or privacy compliance requirements.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this KVM SEV vulnerability. Monitor vendor advisories for kernel updates addressing CVE-2026-63939.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63939. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart