CVE-2026-52959
published 2026-06-24CVE-2026-52959: In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Do not use host-controlled page order in cleanup path When issuing an…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.09%
0.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
virt: sev-guest: Do not use host-controlled page order in cleanup path
When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST),
get_ext_report() allocates a buffer to retrieve a certificate blob from the
host, keeping track of its size in report_req->certs_len.
However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating
an invalid buffer size, as well as the expected length of such buffer.
get_ext_report() subsequently updates report_req->certs_len with the
host-controlled value, and cleans up the buffer by computing a page order
from such value. This is incorrect, as the host-provided length may not
match the page order of the original allocation, potentially resulting
in corruption in the page allocator.
Fix this by using alloc_pages_exact() instead, and reusing @npages to
compute the size passed to free_pages_exact(). For consistency, also
use @npages to compute the size when allocating the pages, even though
this last change has no functional effect.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 3e385c0d6ce88ac9916dcf84267bd5855d830748 < 3f6fb0211b39aaa1b841260681dd02ca6b693ed5 | 3f6fb0211b39aaa1b841260681dd02ca6b693ed5 |
| linux | linux | >= 3e385c0d6ce88ac9916dcf84267bd5855d830748 < 9e48b4f813d2c3db75d522aa82ab705ce04b7e2d | 9e48b4f813d2c3db75d522aa82ab705ce04b7e2d |
| linux | linux | >= 3e385c0d6ce88ac9916dcf84267bd5855d830748 < 23e6a1ca04ae44806439a5a446e62e4d42e80bb4 | 23e6a1ca04ae44806439a5a446e62e4d42e80bb4 |
| linux | linux | >= 6.13.8 < 6.14 | 6.14 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.13.8 < 6.14 | 6.14 |
| linux | linux_kernel | >= 6.14.1 < 6.18.33 | 6.18.33 |
| linux | linux_kernel | >= 6.19 < 7.0.10 | 7.0.10 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: virt: sev-guest: Do not use host-controlled page order in cleanup path
vendor_redhat·2026-06-24
CVE-2026-52959 CWE-131 kernel: virt: sev-guest: Do not use host-controlled page order in cleanup path
kernel: virt: sev-guest: Do not use host-controlled page order in cleanup path
A flaw was found in the Linux kernel's Secure Encrypted Virtualization (SEV) guest module. This vulnerability allows a malicious host to provide an invalid buffer size during an extended guest request. This incorrect handling of host-controlled page order during the cleanup process can lead to a mismatch between the allocated and freed buffer sizes, potentially resulting in corruption within the page allocator. This corruption could lead to system instability or a denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7)
VulDB
Linux Kernel up to 6.18.32/7.0.9 virt get_ext_report certificate validation (WID-SEC-2026-2077)
vuldb·2026-07-17·CVSS 7.8
CVE-2026-52959 [HIGH] Linux Kernel up to 6.18.32/7.0.9 virt get_ext_report certificate validation (WID-SEC-2026-2077)
A vulnerability classified as critical was found in Linux Kernel up to 6.18.32/7.0.9. This vulnerability affects the function get_ext_report of the component virt. Such manipulation leads to improper certificate validation.
This vulnerability is referenced as CVE-2026-52959. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is advised.
GHSA
In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Do not use host-controlled page order in cleanup path When issuing an extended guest request (SVM_VMGEXIT_EXT_GUE
ghsa_unreviewed·2026-06-24
CVE-2026-52959 In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Do not use host-controlled page order in cleanup path When issuing an extended guest request (SVM_VMGEXIT_EXT_GUE
In the Linux kernel, the following vulnerability has been resolved:
virt: sev-guest: Do not use host-controlled page order in cleanup path
When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST),
get_ext_report() allocates a buffer to retrieve a certificate blob from the
host, keeping track of its size in report_req->certs_len.
However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating
an invalid buffer size, as well as the expected length of such buffer.
get_ext_report() subsequently updates report_req->certs_len with the
host-controlled value, and cleans up the buffer by computing a page order
from such value. This is incorrect, as the host-provided length may not
match the page order of the original allocation, potentially resulting
in corruption in the pag
No detection rules found.
No public exploits indexed.
2026-06-24
Published