CVE-2026-52959 Overview
CVE-2026-52959 is a Linux kernel vulnerability in the AMD Secure Encrypted Virtualization (SEV) guest driver. The flaw resides in the get_ext_report() function within the virt: sev-guest subsystem. When a guest issues an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST), the driver allocates a buffer for a certificate blob returned by the host. The cleanup path computes a page order from a host-controlled length value (report_req->certs_len), which may not match the page order of the original allocation. This mismatch can corrupt the kernel page allocator state.
Critical Impact
A malicious or compromised hypervisor can trigger page allocator corruption in a confidential SEV guest, undermining the trust boundary between guest and host.
Affected Products
- Linux kernel virt/sev-guest driver (AMD SEV-SNP guest support)
- Confidential computing workloads running on AMD SEV-SNP
- Distributions shipping affected stable kernel branches prior to the referenced fixes
Discovery Timeline
- 2026-06-24 - CVE CVE-2026-52959 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52959
Vulnerability Analysis
The vulnerability affects the AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) guest driver in the Linux kernel. When a confidential guest issues SVM_VMGEXIT_EXT_GUEST_REQUEST, the get_ext_report() function allocates pages to receive a certificate blob from the host. The original allocation size is tracked locally in pages.
If the host responds with SNP_GUEST_VMM_ERR_INVALID_LEN, it also provides an expected buffer length. The driver writes this host-supplied value back into report_req->certs_len. The cleanup path then converts that length into a page order and frees the buffer accordingly. Because the host controls this value, the page order computed during free can differ from the order used during allocation, producing inconsistent state in the buddy allocator.
This is a memory management correctness issue [CWE-787]-adjacent in effect, where freeing pages with an incorrect order corrupts allocator metadata. The fix replaces the order-based API with alloc_pages_exact() and free_pages_exact(), sizing both calls from the locally tracked npages value rather than from host-supplied data.
Root Cause
The root cause is trusting a host-controlled length field to derive the page order used in the free path. Confidential computing models treat the hypervisor as untrusted, so the guest driver must not allow host input to dictate allocator parameters.
Attack Vector
A malicious or compromised hypervisor returns a crafted certs_len value alongside SNP_GUEST_VMM_ERR_INVALID_LEN. When the guest frees the buffer using the host-supplied length, the page allocator may release the wrong number of pages or corrupt free-list metadata, leading to kernel instability or further memory corruption inside the guest.
The vulnerability requires guest-side execution of the extended report path and a hostile host endpoint. No verified public exploit code is available at this time. See the referenced kernel commits for technical details on the fix.
Detection Methods for CVE-2026-52959
Indicators of Compromise
- Unexpected kernel warnings or BUG reports originating from the page allocator (mm/page_alloc.c) on SEV-SNP guests
- Crashes or Bad page state messages following SVM_VMGEXIT_EXT_GUEST_REQUEST activity
- Kernel logs referencing sev-guest cleanup paths immediately preceding allocator faults
Detection Strategies
- Inventory running kernel versions across SEV-SNP guest fleets and compare against the patched stable commits 23e6a1c, 3f6fb02, and 9e48b4f
- Monitor guest dmesg output for sev-guest errors paired with allocator warnings
- Audit confidential VM images at build time to confirm they include the fixed virt/sev-guest driver
Monitoring Recommendations
- Forward guest kernel logs to a centralized telemetry pipeline for anomaly review
- Alert on repeated SNP_GUEST_VMM_ERR_INVALID_LEN responses observed by guests, which may indicate a misbehaving or hostile host
- Track kernel panic and oops rates on SEV-SNP guests as a baseline deviation signal
How to Mitigate CVE-2026-52959
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in commits 23e6a1c, 3f6fb02, and 9e48b4f
- Rebuild and redeploy SEV-SNP guest images with the patched kernel
- Coordinate with distribution vendors to confirm backports to long-term support branches
Patch Information
The fix replaces __get_free_pages()/order-based freeing with alloc_pages_exact() and free_pages_exact() in get_ext_report(). Both the allocation and free sizes are derived from the guest-tracked npages variable, removing any dependency on host-controlled values for allocator bookkeeping. Patched commits are available on git.kernel.org stable branches.
Workarounds
- No documented runtime workaround eliminates the issue; kernel update is required
- Where patching is delayed, restrict workloads on SEV-SNP guests to trusted hypervisor environments and limit use of the extended guest request path
- Treat any host-reported SNP_GUEST_VMM_ERR_INVALID_LEN event as suspect and investigate the underlying host
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
