CVE-2026-64285
Received Received - Intake

KVM SEV Memory Corruption in Linux Kernel

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guest_memfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the "correct" CPUID information if the userspace provided data is rejected by trusted firmware. Because KVM writes to the source page using a kernel mapping, pinning for read could result in KVM clobbering read-only memory. Note, well-behaved VMMs are unlikely to be affected, as CPUID information is almost always dynamically generated by userspace, i.e. it's unlikely for the CPUID information to be backed by a read-only mapping. [sean: rewrite shortlog and changelog, tag for stable@]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64285
EUVD
EUVD-2026-48997

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a missing write protection when adding CPUID data for an SEV (Secure Encrypted Virtualization) guest. KVM (Kernel-based Virtual Machine) writes corrected CPUID information back to the source page, but if that page is read-only, it could corrupt memory. The fix ensures the page is pinned as writable to prevent this issue.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM SEV implementation and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying if the system uses affected kernel versions. Commands like 'dmesg | grep -i sev' or 'uname -a' may help identify exposure.

Impact Analysis

If exploited, this could allow a guest VM to corrupt host memory by tricking KVM into writing to a read-only page. This may lead to system crashes, privilege escalation, or denial of service. However, the risk is low for typical setups since CPUID data is usually dynamically generated.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. Monitor vendor advisories for kernel updates and apply them promptly. If using KVM with SEV, ensure VMMs are configured to avoid read-only CPUID mappings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64285. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart