CVE-2026-63938: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63938 Overview

CVE-2026-63938 is a Linux kernel vulnerability in the KVM Secure Encrypted Virtualization (SEV) subsystem. The flaw resides in the Page State Change (PSC) request handling logic. The kernel failed to validate PSC request indices against the effective size of the scratch buffer. When a guest supplies a Guest Hypervisor Communication Block (GHCB) shared buffer pointer that is not aligned to the start of the buffer, the effective scratch area shrinks below the maximum size. The kernel proceeded to process requests using the maximum size assumption, enabling out-of-bounds access.

Critical Impact
A malicious or compromised SEV guest can trigger out-of-bounds memory access in the host kernel, leading to host compromise, information disclosure, or denial of service.

Affected Products

Linux kernel with KVM AMD SEV support enabled
Systems running SEV-SNP capable AMD EPYC hardware with vulnerable kernel versions
Hypervisor hosts exposing KVM SEV to untrusted guest workloads

Discovery Timeline

2026-07-19 - CVE-2026-63938 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63938

Vulnerability Analysis

The vulnerability affects the KVM SEV code path that processes Page State Change requests issued by encrypted guests via the GHCB protocol. Guests communicate with the hypervisor through a shared GHCB page and can point the hypervisor at a scratch buffer for bulk operations such as PSC. The kernel treated the scratch area as if it always spanned the full maximum size. When a guest provides a scratch pointer offset from the start of the GHCB shared buffer, the actual usable region is smaller than the maximum. Requests indexed against the assumed maximum can read or write past the valid buffer boundary. The issue is classified as an out-of-bounds access [CWE-125/CWE-787] in privileged host code.

Root Cause

The root cause is missing bounds validation. The PSC handler compared request indices against a hardcoded maximum PSC buffer size rather than the effective size derived from the guest-supplied scratch pointer and its offset within the GHCB shared buffer. This mismatch permitted index values that fall within the theoretical maximum but exceed the actual allocated scratch region.

Attack Vector

Exploitation requires the ability to run code inside an SEV guest and issue crafted GHCB PSC requests. An attacker who controls a guest can align the scratch pointer at an arbitrary offset within the GHCB shared buffer, shrinking the effective scratch area. The attacker then submits PSC requests with indices calculated to fall outside the effective region but inside the assumed maximum. The scope is changed (S:C in the CVSS vector) because the vulnerability crosses the guest-host trust boundary, enabling impact on the hypervisor from within a guest.

No verified proof-of-concept code has been published. Refer to the upstream fix commits (121d88d, 505a3b9, 5198f70, 75c8d1d) for the exact validation logic added to the PSC handler.

Detection Methods for CVE-2026-63938

Indicators of Compromise

Unexpected kernel oops or panic traces referencing SEV, GHCB, or PSC handling functions in arch/x86/kvm/svm/sev.c
KVM guest exits with anomalous GHCB scratch pointer offsets that do not align to the start of the shared buffer
Host kernel memory corruption symptoms coinciding with SEV guest activity, including KASAN reports on SEV code paths

Detection Strategies

Audit installed kernel versions across hypervisor hosts and compare against fixed stable branches referenced in the upstream commits
Enable KASAN or KFENCE on test hypervisor builds to surface out-of-bounds reads and writes in the PSC handler during guest fuzzing
Correlate guest lifecycle events with host dmesg entries mentioning snp_complete_psc, setup_vmgexit_scratch, or GHCB validation

Monitoring Recommendations

Ship hypervisor kernel logs and KVM tracepoints to a centralized analytics platform for anomaly detection on SEV guest behavior
Monitor for guests issuing large volumes of PSC requests or repeated VMGEXIT calls with non-standard scratch buffer layouts
Track host stability metrics such as unexpected reboots, kernel oops counts, and CPU soft-lockups on SEV-enabled nodes

How to Mitigate CVE-2026-63938

Immediate Actions Required

Apply the upstream Linux kernel fixes and update to a distribution kernel that incorporates commits 121d88d, 505a3b9, 5198f70, and 75c8d1d
Inventory all AMD SEV-enabled hypervisor hosts and prioritize patching those hosting multi-tenant or untrusted guests
Restrict the ability to launch SEV guests to trusted administrators until patched kernels are deployed

Patch Information

The fix validates PSC request indices against the effective size of the scratch area rather than the maximum size. The effective size accounts for the offset of the guest-supplied scratch pointer within the GHCB shared buffer. Stable kernel branches received backports via the four referenced commits on git.kernel.org. Consult your Linux distribution's security advisories for the specific package versions that include this fix.

Workarounds

Disable AMD SEV on hypervisor hosts that do not require confidential VM workloads by unloading or blacklisting the kvm_amd module with sev=0
Avoid running untrusted or attacker-controlled workloads inside SEV guests on unpatched hosts
Isolate SEV-enabled hypervisors from general-purpose tenant workloads until the kernel update is applied

bash

# Verify running kernel and confirm patched version is installed
uname -r

# Check whether AMD SEV is currently enabled on the host
cat /sys/module/kvm_amd/parameters/sev

# Temporarily disable SEV on the host by setting the kvm_amd module parameter
echo 'options kvm_amd sev=0' | sudo tee /etc/modprobe.d/disable-sev.conf
sudo update-initramfs -u

# Reboot required for the module parameter change to take effect
sudo reboot