CVE-2026-64104
Received Received - Intake

Memory Leak in Linux Kernel SEV-Guest Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly leak pages in unknown state When set_memory_{encrypted,decrypted}() fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view of the caller. Since the pages may be left in an unencrypted state, they are not suitable for general use, and cannot be returned safely to the buddy allocator. Avoid the issue by never freeing the pages, and then do the proper accounting by calling snp_leak_pages().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64104
EUVD
EUVD-2026-45789

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of memory pages when encryption or decryption operations fail. When the functions set_memory_encrypted() or set_memory_decrypted() fail, the system cannot determine the state of the affected pages, leaving them in an unknown condition. This creates a risk because unencrypted pages may be improperly reused, potentially exposing sensitive data.

Detection Guidance

This vulnerability is specific to the Linux kernel's SEV-Guest driver and cannot be detected through standard network scanning or general system commands. It requires kernel-level inspection for memory state mismatches in encrypted/decrypted pages. Check kernel logs for errors related to set_memory_{encrypted,decrypted}() failures or SEV-Guest driver issues.

Impact Analysis

This vulnerability could lead to memory corruption or unauthorized access to sensitive data if unencrypted pages are reused improperly. Systems relying on memory encryption for security may be compromised, potentially allowing attackers to read or manipulate data stored in memory.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to memory management in the Linux kernel. The issue involves improper handling of memory pages during encryption/decryption failures, which could lead to unencrypted data remaining in memory. However, no specific compliance implications are mentioned in the provided context.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Monitor kernel logs for failures in memory encryption/decryption operations. Ensure the SEV-Guest driver is updated to handle page leaks properly. Avoid using affected kernel versions until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64104. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart