CVE-2026-63794: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63794 Overview

CVE-2026-63794 is a page overflow vulnerability in the Linux kernel's KVM Secure Encrypted Virtualization (SVM) subsystem. The flaw resides in the sev_dbg_crypt() function within the AMD SEV debug encryption path. The per-iteration transfer length is bounded by the source page offset but not by the destination page offset, allowing an out-of-bounds write of up to a full page beyond a 4096-byte allocation. KASAN identified this as a slab-use-after-free write during triggering. The issue affects the __sev_dbg_encrypt_user read-modify-write logic that uses a single-page intermediate buffer dst_tpage.

Critical Impact
A local user with access to KVM SEV debug ioctls can trigger an out-of-bounds heap write of up to 4095 bytes, corrupting adjacent slab memory and potentially escalating to kernel memory corruption.

Affected Products

Linux kernel builds with KVM AMD (kvm_amd) module and SEV support enabled
Host systems running AMD EPYC processors with SEV-capable firmware
Distributions shipping vulnerable kernel versions prior to the referenced stable patch commits

Discovery Timeline

2026-07-19 - CVE-2026-63794 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63794

Vulnerability Analysis

The vulnerability exists in sev_dbg_crypt() within the KVM AMD SEV subsystem. Debug encryption operations copy guest memory through a single-page intermediate buffer named dst_tpage. The code computes the per-iteration transfer length using only the source page offset (PAGE_SIZE - s_off), ignoring the destination page offset d_off.

When d_off > s_off, the destination write extends past the 4096-byte allocation. The __sev_dbg_decrypt() helper first expands the size to round_up(len + (d_off & 15), 16) before issuing the Platform Security Processor (PSP) command. This causes the PSP to write beyond the buffer end. A subsequent memcpy() or copy_from_user() into page_address(dst_tpage) + (d_off & 15) compounds the overflow by up to 15 additional bytes.

Root Cause

The root cause is missing bounds enforcement against the destination page offset. The sev_send_update_data() sibling function already performs the correct check by bounding transfer length against (PAGE_SIZE - d_off). The debug encrypt path omits this guard, permitting length values that overflow the single-page scratch buffer during PSP-driven read-modify-write cycles.

Attack Vector

A trigger example uses s_off = 0, d_off = 1, and debug.len = PAGE_SIZE. The PSP is instructed to write round_up(4097, 16) = 4112 bytes into a 4096-byte buffer. Exploitation requires local access to issue the KVM_SEV_DBG_ENCRYPT ioctl through /dev/kvm, which typically requires privileges to interact with the KVM device. The KASAN splat confirms a 4095-byte out-of-bounds write in slab memory reachable through sev_mem_enc_ioctl and kvm_vm_ioctl.

See the upstream patches referenced below for the corrected boundary check. No verified public exploit code exists at this time.

Detection Methods for CVE-2026-63794

Indicators of Compromise

KASAN reports flagging slab-use-after-free writes originating in sev_dbg_crypt+0x993/0xd10 [kvm_amd]
Kernel oops or panic messages referencing sev_mem_enc_ioctl and __asan_memcpy in the call trace
Unexpected slab corruption on hosts running SEV-enabled guests

Detection Strategies

Enable KASAN on test kernels to surface out-of-bounds writes in the SEV debug path during fuzzing or validation
Audit host auditd logs for unexpected ioctl invocations with KVM_SEV_DBG_ENCRYPT command codes from non-privileged workloads
Compare deployed kernel versions against the fixed commits listed in the kernel.org stable references

Monitoring Recommendations

Monitor process access to /dev/kvm and correlate with unusual guest lifecycle events
Track kernel taint flag transitions and warning messages emitted from kvm_amd on production hypervisors
Alert on repeated ioctl failures returning EINVAL or EFAULT from SEV memory encryption paths, which may indicate exploit development attempts

How to Mitigate CVE-2026-63794

Immediate Actions Required

Apply the upstream stable kernel patches that add the (PAGE_SIZE - d_off) bound to sev_dbg_crypt() transfer length calculations
Restrict access to /dev/kvm to trusted users and services only, using group membership and udev rules
Disable SEV debug capabilities on production hosts that do not require guest debugging

Patch Information

Fixes are available in the upstream Linux kernel stable trees. Reference the following commits: Kernel Patch 2753a09, Kernel Patch 64f24498, Kernel Patch 720949ed, Kernel Patch 78ee2d50, Kernel Patch 889c2a9c, Kernel Patch 9349b50f, Kernel Patch e1a0fe28, and Kernel Patch f701ae47. The fix bounds len by (PAGE_SIZE - d_off), matching the check already performed by sev_send_update_data().

Workarounds

Blacklist or unload the kvm_amd module on hosts that do not run AMD SEV guests
Enforce strict ACLs on /dev/kvm so only vetted virtualization services can issue SEV ioctls
Disable guest debug functionality in orchestration layers such as libvirt or Kubernetes CRI-O until patched kernels are deployed

bash

# Restrict /dev/kvm access to the kvm group only
sudo chown root:kvm /dev/kvm
sudo chmod 0660 /dev/kvm

# Verify running kernel does not expose the vulnerable code path unnecessarily
lsmod | grep kvm_amd

# Optional: unload kvm_amd on hosts that do not need AMD virtualization
sudo modprobe -r kvm_amd