CVE-2026-80853: Linux Kernel KVM SEV Privilege Escalation

CVE-2026-80853 Overview

CVE-2026-80853 is a Linux kernel vulnerability in the Kernel-based Virtual Machine (KVM) subsystem affecting AMD Secure Encrypted Virtualization (SEV) and SEV-ES guest handling on Secure Nested Paging (SNP) enabled hosts. When KVM encrypts or decrypts guest memory through a temporary buffer, it previously used a sub-page allocation. On SNP-enabled platforms, transferring ownership of a page to firmware makes it inaccessible to software, so any concurrent kernel allocation sharing that page triggers a Reverse Map Table (RMP) page fault. The fix allocates a full 4KiB page so KVM wholly owns the buffer page.

Critical Impact
Concurrent kernel access to a firmware-owned page triggers an RMP #PF violation that produces a kernel oops and fatal panic on SNP-enabled AMD hosts running SEV or SEV-ES guests.

Affected Products

Linux kernel with KVM AMD (kvm_amd) module on SNP-enabled hosts
Systems running SEV or SEV-ES guests on AMD SNP-capable platforms
Kernel versions prior to commits 97f6402f5950ca3450541287c4b3664f3acda976 and a33c40b93ccf5177e042253807d40e0b92e7f206

Discovery Timeline

2026-09-04 - CVE-2026-80853 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80853

Vulnerability Analysis

The vulnerability resides in the KVM SEV command path that performs encrypt and decrypt operations on guest memory. The path uses a temporary buffer to stage data for the AMD Secure Processor firmware. On SNP-enabled hosts, firmware writes to that buffer require the containing page to be assigned to Firmware ownership via the RMP. Once assigned, software access to any byte on that page generates an RMP page fault.

Because the original allocation was smaller than a full page, the same physical page could be handed out to unrelated kernel allocators. When another kernel thread touched its portion of the shared page while KVM held the firmware assignment, the CPU raised an RMP violation. The reference oops shows a write fault inside memset reached through __kvmalloc_node_noprof from do_getxattr, unrelated to KVM, resulting in a fatal kernel panic.

Root Cause

The root cause is a page-ownership boundary violation. KVM used a sub-page temporary buffer through snp_map_cmd_buf_desc() and related helpers, but SNP page assignment operates at 4KiB granularity. Sharing the underlying page with other kernel consumers created a race window in which firmware-owned memory was accessible to unrelated code paths, producing spurious RMP #PF violations.

Attack Vector

The defect manifests during normal SEV or SEV-ES guest operation on an SNP-enabled host and does not require a malicious actor. Any workload that causes concurrent slab or kvmalloc allocations from the same page as the KVM temporary buffer can trigger the fault. The result is a denial of service through kernel panic on the host, impacting all tenants on that machine. The upstream fix allocates a full page so no other kernel code can share the assigned region. See the patch commits 97f6402f and a33c40b9 for the corrective changes.

Detection Methods for CVE-2026-80853

Indicators of Compromise

Kernel oops entries referencing RMP violation with error_code(0x80000003) in dmesg or /var/log/kern.log
Panic traces containing memset faults reached through __kvmalloc_node_noprof on SNP-enabled hosts
Log lines of the form SEV-SNP: PFN 0x... unassigned, dumping non-zero entries in 2M PFN region
Unexpected host reboots on AMD servers actively running SEV or SEV-ES guests

Detection Strategies

Inventory hosts loading the kvm_amd module with SNP enabled and correlate against kernel build versions to identify unpatched systems.
Parse kernel ring buffers for RMP violation strings and forward matches to centralized log analytics for host-level alerting.
Track host uptime and unplanned reboot events on SEV/SNP hypervisors to surface panics that may have been triggered by this defect.

Monitoring Recommendations

Ingest hypervisor dmesg output and kernel crash dumps into a centralized log platform for retention and query.
Alert on any Kernel panic - not syncing: Fatal exception message originating from AMD SEV hosts.
Baseline the frequency of RMP violation messages so any new occurrence generates an investigation ticket.

How to Mitigate CVE-2026-80853

Immediate Actions Required

Apply a Linux kernel update that includes commits 97f6402f5950ca3450541287c4b3664f3acda976 and a33c40b93ccf5177e042253807d40e0b92e7f206.
Prioritize patching AMD hosts that run SEV or SEV-ES guests with SNP enabled, since these are the systems exposed to the fault.
Coordinate live migration or maintenance windows to reboot into the patched kernel without disrupting confidential VM tenants.

Patch Information

The fix modifies the KVM SEV encrypt and decrypt paths to allocate a full 4KiB page for the temporary buffer, ensuring exclusive ownership when the page is assigned to firmware. Distribution vendors have backported the change to supported stable trees. Consult the upstream commits 97f6402f and a33c40b9 and your distribution's security advisories for backport availability.

Workarounds

Disable SEV-SNP on affected hosts if confidential computing is not required, which removes the RMP enforcement path that triggers the fault.
Avoid running SEV or SEV-ES guests on SNP-enabled hosts until the patched kernel is deployed.
Where feasible, migrate confidential workloads to already-patched hosts and quarantine unpatched hypervisors from new VM placements.