CVE-2026-53360 (GCVE-0-2026-53360)
Vulnerability from cvelistv5 – Published: 2026-07-04 11:53 – Updated: 2026-07-04 11:53
VLAI
Title
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
As per the GHCB spec, when using GHCB v2+ require the software scratch area
to reside in the GHCB's shared buffer. Note, things like Page State Change
(PSC) requests _rely_ on this behavior, as the guest can't provide a length
when making the request, i.e. the size of the guest payload is bounded by
the size of the shared buffer.
Failure to force usage of the GHCB, and a slew of other flaws, lets a
malicious SNP guest corrupt host kernel heap memory, and leak host heap
layout information.
setup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2),
where exit_info_2 is guest-controlled. With exit_info_2=24, this yields
a 24-byte allocation in kmalloc-cg-32 (32-byte slab objects). The buffer
holds an 8-byte psc_hdr followed by 8-byte psc_entry structs, so only
entries[0] and entries[1] are in-bounds.
snp_begin_psc() validates end_entry against VMGEXIT_PSC_MAX_COUNT (253)
but NOT against the actual buffer size:
idx_end = hdr->end_entry;
if (idx_end >= VMGEXIT_PSC_MAX_COUNT) { // checks 253, not buffer
snp_complete_psc(svm, ...);
return 1;
}
for (idx = idx_start; idx <= idx_end; idx++) {
entry_start = entries[idx]; // OOB when idx >= 2
The guest sets end_entry=10+, causing the host to iterate entries[2+]
which are OOB into adjacent slab objects. For each OOB entry:
- The host reads 8 bytes (OOB READ / info leak oracle)
- If the data passes PSC validation, __snp_complete_one_psc() writes
cur_page = 1 or 512 into the entry (OOB WRITE, sev.c:3806)
- If validation fails, the error response reveals whether adjacent
memory is zero vs non-zero (information disclosure to guest)
The guest controls allocation size (exit_info_2), entry range
(cur_entry/end_entry), and can fire unlimited VMGEXITs to repeatedly
hit different slab positions.
By exploiting the variety of bugs, a malicious SEV-SNP guest can:
- OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure)
- OOB write cur_page bits into adjacent objects (heap corruption)
- Trigger use-after-free conditions across VMGEXITs
E.g. with KASAN enabled, a single insmod of the PoC guest module
produces 73 KASAN reports:
BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x126/0x890
Read of size 8 at addr ffff888219ffb5e0 by task qemu-system-x86/2199
BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468/0x890
Write of size 8 at addr ffff888351566648 by task qemu-system-x86/2199
The buggy address belongs to the object at ffff888XXXXXXXXX
which belongs to the cache kmalloc-cg-32 of size 32
The buggy address is located N bytes to the right of
allocated 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX)
Breakdown:
62 slab-out-of-bounds (reads + writes past allocation)
7 slab-use-after-free
4 use-after-free
All credit to Stan for the wonderful description and reproducer!
[sean: write changelog]
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4af663c2f64a8d252e690c60cf8b8abf22dc2951 , < bf9ba093fbb83c0c9a3dedd50efec29424eca2fc
(git)
Affected: 4af663c2f64a8d252e690c60cf8b8abf22dc2951 , < c9b4198fbc6ed99a9da4bee9f74bb730f926c9ae (git) Affected: 4af663c2f64a8d252e690c60cf8b8abf22dc2951 , < b328ede59ac34e7998e1eee5e5f0cc26c2a91846 (git) Affected: 4af663c2f64a8d252e690c60cf8b8abf22dc2951 , < db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7 (git) |
|
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/sev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bf9ba093fbb83c0c9a3dedd50efec29424eca2fc",
"status": "affected",
"version": "4af663c2f64a8d252e690c60cf8b8abf22dc2951",
"versionType": "git"
},
{
"lessThan": "c9b4198fbc6ed99a9da4bee9f74bb730f926c9ae",
"status": "affected",
"version": "4af663c2f64a8d252e690c60cf8b8abf22dc2951",
"versionType": "git"
},
{
"lessThan": "b328ede59ac34e7998e1eee5e5f0cc26c2a91846",
"status": "affected",
"version": "4af663c2f64a8d252e690c60cf8b8abf22dc2951",
"versionType": "git"
},
{
"lessThan": "db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7",
"status": "affected",
"version": "4af663c2f64a8d252e690c60cf8b8abf22dc2951",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/sev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use\n\nAs per the GHCB spec, when using GHCB v2+ require the software scratch area\nto reside in the GHCB\u0027s shared buffer. Note, things like Page State Change\n(PSC) requests _rely_ on this behavior, as the guest can\u0027t provide a length\nwhen making the request, i.e. the size of the guest payload is bounded by\nthe size of the shared buffer.\n\nFailure to force usage of the GHCB, and a slew of other flaws, lets a\nmalicious SNP guest corrupt host kernel heap memory, and leak host heap\nlayout information.\n\nsetup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2),\nwhere exit_info_2 is guest-controlled. With exit_info_2=24, this yields\na 24-byte allocation in kmalloc-cg-32 (32-byte slab objects). The buffer\nholds an 8-byte psc_hdr followed by 8-byte psc_entry structs, so only\nentries[0] and entries[1] are in-bounds.\n\nsnp_begin_psc() validates end_entry against VMGEXIT_PSC_MAX_COUNT (253)\nbut NOT against the actual buffer size:\n\n idx_end = hdr-\u003eend_entry;\n\n if (idx_end \u003e= VMGEXIT_PSC_MAX_COUNT) { // checks 253, not buffer\n snp_complete_psc(svm, ...);\n return 1;\n }\n\n for (idx = idx_start; idx \u003c= idx_end; idx++) {\n entry_start = entries[idx]; // OOB when idx \u003e= 2\n\nThe guest sets end_entry=10+, causing the host to iterate entries[2+]\nwhich are OOB into adjacent slab objects. For each OOB entry:\n\n - The host reads 8 bytes (OOB READ / info leak oracle)\n - If the data passes PSC validation, __snp_complete_one_psc() writes\n cur_page = 1 or 512 into the entry (OOB WRITE, sev.c:3806)\n - If validation fails, the error response reveals whether adjacent\n memory is zero vs non-zero (information disclosure to guest)\n\nThe guest controls allocation size (exit_info_2), entry range\n(cur_entry/end_entry), and can fire unlimited VMGEXITs to repeatedly\nhit different slab positions.\n\nBy exploiting the variety of bugs, a malicious SEV-SNP guest can:\n - OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure)\n - OOB write cur_page bits into adjacent objects (heap corruption)\n - Trigger use-after-free conditions across VMGEXITs\n\nE.g. with KASAN enabled, a single insmod of the PoC guest module\nproduces 73 KASAN reports:\n\n BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x126/0x890\n Read of size 8 at addr ffff888219ffb5e0 by task qemu-system-x86/2199\n\n BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468/0x890\n Write of size 8 at addr ffff888351566648 by task qemu-system-x86/2199\n\n The buggy address belongs to the object at ffff888XXXXXXXXX\n which belongs to the cache kmalloc-cg-32 of size 32\n The buggy address is located N bytes to the right of\n allocated 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX)\n\n Breakdown:\n 62 slab-out-of-bounds (reads + writes past allocation)\n 7 slab-use-after-free\n 4 use-after-free\n\nAll credit to Stan for the wonderful description and reproducer!\n\n[sean: write changelog]"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:53:58.657Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bf9ba093fbb83c0c9a3dedd50efec29424eca2fc"
},
{
"url": "https://git.kernel.org/stable/c/c9b4198fbc6ed99a9da4bee9f74bb730f926c9ae"
},
{
"url": "https://git.kernel.org/stable/c/b328ede59ac34e7998e1eee5e5f0cc26c2a91846"
},
{
"url": "https://git.kernel.org/stable/c/db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7"
}
],
"title": "KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53360",
"datePublished": "2026-07-04T11:53:58.657Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-07-04T11:53:58.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-53360",
"date": "2026-07-06",
"epss": "0.00267",
"percentile": "0.18325"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-53360\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-04T12:17:01.880\",\"lastModified\":\"2026-07-04T12:17:01.880\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use\\n\\nAs per the GHCB spec, when using GHCB v2+ require the software scratch area\\nto reside in the GHCB\u0027s shared buffer. Note, things like Page State Change\\n(PSC) requests _rely_ on this behavior, as the guest can\u0027t provide a length\\nwhen making the request, i.e. the size of the guest payload is bounded by\\nthe size of the shared buffer.\\n\\nFailure to force usage of the GHCB, and a slew of other flaws, lets a\\nmalicious SNP guest corrupt host kernel heap memory, and leak host heap\\nlayout information.\\n\\nsetup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2),\\nwhere exit_info_2 is guest-controlled. With exit_info_2=24, this yields\\na 24-byte allocation in kmalloc-cg-32 (32-byte slab objects). The buffer\\nholds an 8-byte psc_hdr followed by 8-byte psc_entry structs, so only\\nentries[0] and entries[1] are in-bounds.\\n\\nsnp_begin_psc() validates end_entry against VMGEXIT_PSC_MAX_COUNT (253)\\nbut NOT against the actual buffer size:\\n\\n idx_end = hdr-\u003eend_entry;\\n\\n if (idx_end \u003e= VMGEXIT_PSC_MAX_COUNT) { // checks 253, not buffer\\n snp_complete_psc(svm, ...);\\n return 1;\\n }\\n\\n for (idx = idx_start; idx \u003c= idx_end; idx++) {\\n entry_start = entries[idx]; // OOB when idx \u003e= 2\\n\\nThe guest sets end_entry=10+, causing the host to iterate entries[2+]\\nwhich are OOB into adjacent slab objects. For each OOB entry:\\n\\n - The host reads 8 bytes (OOB READ / info leak oracle)\\n - If the data passes PSC validation, __snp_complete_one_psc() writes\\n cur_page = 1 or 512 into the entry (OOB WRITE, sev.c:3806)\\n - If validation fails, the error response reveals whether adjacent\\n memory is zero vs non-zero (information disclosure to guest)\\n\\nThe guest controls allocation size (exit_info_2), entry range\\n(cur_entry/end_entry), and can fire unlimited VMGEXITs to repeatedly\\nhit different slab positions.\\n\\nBy exploiting the variety of bugs, a malicious SEV-SNP guest can:\\n - OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure)\\n - OOB write cur_page bits into adjacent objects (heap corruption)\\n - Trigger use-after-free conditions across VMGEXITs\\n\\nE.g. with KASAN enabled, a single insmod of the PoC guest module\\nproduces 73 KASAN reports:\\n\\n BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x126/0x890\\n Read of size 8 at addr ffff888219ffb5e0 by task qemu-system-x86/2199\\n\\n BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468/0x890\\n Write of size 8 at addr ffff888351566648 by task qemu-system-x86/2199\\n\\n The buggy address belongs to the object at ffff888XXXXXXXXX\\n which belongs to the cache kmalloc-cg-32 of size 32\\n The buggy address is located N bytes to the right of\\n allocated 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX)\\n\\n Breakdown:\\n 62 slab-out-of-bounds (reads + writes past allocation)\\n 7 slab-use-after-free\\n 4 use-after-free\\n\\nAll credit to Stan for the wonderful description and reproducer!\\n\\n[sean: write changelog]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/svm/sev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4af663c2f64a8d252e690c60cf8b8abf22dc2951\",\"lessThan\":\"bf9ba093fbb83c0c9a3dedd50efec29424eca2fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4af663c2f64a8d252e690c60cf8b8abf22dc2951\",\"lessThan\":\"c9b4198fbc6ed99a9da4bee9f74bb730f926c9ae\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4af663c2f64a8d252e690c60cf8b8abf22dc2951\",\"lessThan\":\"b328ede59ac34e7998e1eee5e5f0cc26c2a91846\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4af663c2f64a8d252e690c60cf8b8abf22dc2951\",\"lessThan\":\"db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/svm/sev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.93\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.35\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b328ede59ac34e7998e1eee5e5f0cc26c2a91846\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bf9ba093fbb83c0c9a3dedd50efec29424eca2fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c9b4198fbc6ed99a9da4bee9f74bb730f926c9ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…