CVE-2026-63937

Summary

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer

Use READ_ONCE() when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs.

Don't bother with READ_ONCE()/WRITE_ONCE() for cases where KVM is writing (and not consuming the result!), as the guest isn't supposed to touch the buffer while it's being processed. I.e. using READ_ONCE() is all about protecting against misbehaving guests.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux9b54e248d2644be71cb394eb85f31ad99e023a05 < bd232801ef1d1fd985d2d4ca3cd1d888303ca86faffected
LinuxLinux9b54e248d2644be71cb394eb85f31ad99e023a05 < b1dfaa6f7a957726a6800135be3659fbe4bbf2a4affected
LinuxLinux9b54e248d2644be71cb394eb85f31ad99e023a05 < edbbe88f83b524434974e84808d3093199d67c24affected
LinuxLinux9b54e248d2644be71cb394eb85f31ad99e023a05 < c8cc238093ca6c99267032f6cfe78f59389f3157affected
LinuxLinux6.11affected
LinuxLinux0 < 6.11unaffected
LinuxLinux6.12.93 <= 6.12.*unaffected
LinuxLinux6.18.35 <= 6.18.*unaffected
LinuxLinux7.0.12 <= 7.0.*unaffected
LinuxLinux7.1 <= *unaffected

Weaknesses

References