CVE-2026-52959

virt: sev-guest: Do not use host-controlled page order in cleanup path

Published Jun 24, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

virt: sev-guest: Do not use host-controlled page order in cleanup path

When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST),
get_ext_report() allocates a buffer to retrieve a certificate blob from the
host, keeping track of its size in report_req->certs_len.

However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating
an invalid buffer size, as well as the expected length of such buffer.
get_ext_report() subsequently updates report_req->certs_len with the
host-controlled value, and cleans up the buffer by computing a page order
from such value. This is incorrect, as the host-provided length may not
match the page order of the original allocation, potentially resulting
in corruption in the page allocator.

Fix this by using alloc_pages_exact() instead, and reusing @npages to
compute the size passed to free_pages_exact(). For consistency, also
use @npages to compute the size when allocating the pages, even though
this last change has no functional effect.

Analysis

Technical impact

The vulnerability occurs when the kernel handles an extended guest request. The host can return an error containing an invalid buffer size. The kernel then uses that length to compute a page order for freeing memory, which may not match the original allocation. This can corrupt the page allocator, leading to kernel memory corruption that could allow an attacker to crash the system, gain higher privileges, or cause denial of service.

Affected Systems

Vulnerable configurations exist in the Linux kernel across all variants before the fix. The affected sources are under the Linux kernel CNA; any distribution shipping an older kernel image that has not incorporated the commit references is potentially impacted. Users should verify whether their distribution’s kernel version includes the updates for the sev‑guest cleanup path.

Risk and Exploitability

The flaw is a classic kernel‑mode memory corruption. The CVSS score of 7.8 indicates high severity, while the EPSS score is < 1%, indicating low probability of exploitation. The issue is not listed in CISA KEV. Exploitation requires a guest that can trigger the extended request, so it is limited to virtual machines with the vulnerable kernel. Despite the low probability, the potential impact is severe, warranting prompt attention.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3e385c0d6ce88ac9916dcf84267bd5855d830748`	affected	< 3f6fb0211b39aaa1b841260681dd02ca6b693ed5
`3e385c0d6ce88ac9916dcf84267bd5855d830748`	affected	< 9e48b4f813d2c3db75d522aa82ab705ce04b7e2d
`3e385c0d6ce88ac9916dcf84267bd5855d830748`	affected	< 23e6a1ca04ae44806439a5a446e62e4d42e80bb4
`0b16521f95c875e79d657cb8d6911c15080dbb80`	affected	—
`6.13.8`	affected	< 6.14

Linux

affected

Version	Status	Constraints
`6.14`	affected	—
`0`	unaffected	< 6.14
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.14:-::::::
	cpe:2.3:o:linux:linux_kernel:6.14:rc6::::::
	cpe:2.3:o:linux:linux_kernel:6.14:rc7::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[3e385c0d6ce88ac9916dcf84267bd5855d830748,3f6fb0211b39aaa1b841260681dd02ca6b693ed5)`	affected	code_commit	—
`[3e385c0d6ce88ac9916dcf84267bd5855d830748,9e48b4f813d2c3db75d522aa82ab705ce04b7e2d)`	affected	code_commit	—
`[3e385c0d6ce88ac9916dcf84267bd5855d830748,23e6a1ca04ae44806439a5a446e62e4d42e80bb4)`	affected	code_commit	—
`0b16521f95c875e79d657cb8d6911c15080dbb80`	affected	code_commit	—
`[6.13.8,6.14)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.14`	affected	semver	—
`[0,6.14)`	unaffected	semver	—
`[6.18.33,6.18.*]`	unaffected	semver	—
`[7.0.10,7.0.*]`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install the kernel update that includes the fix for the page order calculation bug.
Update the SVM hypervisor to a version that incorporates the corrected guest request handling.
Monitor kernel logs for panics, abnormal memory allocator activity, or other signs of exploitation attempts.

Generated by OpenCVE AI on August 13, 2026 at 15:42 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8566-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8568-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8569-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.113% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/23e6a1ca04ae44806439a5a446e62e4d42e80bb4
https://git.kernel.org/stable/c/3f6fb0211b39aaa1b841260681dd02ca6b693ed5
https://git.kernel.org/stable/c/9e48b4f813d2c3db75d522aa82ab705ce04b7e2d
https://lore.kernel.org/linux-cve-announce/2026062436-CVE-2026-52959-1796@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-52959
https://www.cve.org/CVERecord?id=CVE-2026-52959

History

Jun 28, 2026 8:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Jun 26, 2026 4:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-239 CWE-787

Jun 26, 2026 12:15 AM Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Weaknesses		CWE-131
References		https://lore.kernel.org/linux-cve-announce/2026062436-CVE-2026-52959-1796@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-52959 https://www.cve.org/CVERecord?id=CVE-2026-52959

Jun 24, 2026 7:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-239 CWE-787

Jun 24, 2026 5:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Do not use host-controlled page order in cleanup path When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST), get_ext_report() allocates a buffer to retrieve a certificate blob from the host, keeping track of its size in report_req->certs_len. However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating an invalid buffer size, as well as the expected length of such buffer. get_ext_report() subsequently updates report_req->certs_len with the host-controlled value, and cleans up the buffer by computing a page order from such value. This is incorrect, as the host-provided length may not match the page order of the original allocation, potentially resulting in corruption in the page allocator. Fix this by using alloc_pages_exact() instead, and reusing @npages to compute the size passed to free_pages_exact(). For consistency, also use @npages to compute the size when allocating the pages, even though this last change has no functional effect.
Title		virt: sev-guest: Do not use host-controlled page order in cleanup path
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/23e6a1ca04ae44806439a5a446e62e4d42e80bb4 https://git.kernel.org/stable/c/3f6fb0211b39aaa1b841260681dd02ca6b693ed5 https://git.kernel.org/stable/c/9e48b4f813d2c3db75d522aa82ab705ce04b7e2d