CVE-2026-63938
published 2026-07-19CVE-2026-63938: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing…
PriorityP346critical9.3CVSS 3.1
AVLACLPRNUINSCCHIHAH
EPSS
0.18%
7.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Check PSC request indices against the actual size of the buffer
When processing Page State Change (PSC) requests, validate the PSC buffer
against the effective size of the scratch area, which could be less than
the maximum size if the guest provided a pointer that isn't exactly at the
start of the GHCB shared buffer.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 9b54e248d2644be71cb394eb85f31ad99e023a05 < 5198f70c09a5f6e9e5f5a0a2c6b388f24294b176 | 5198f70c09a5f6e9e5f5a0a2c6b388f24294b176 |
| linux | linux | >= 9b54e248d2644be71cb394eb85f31ad99e023a05 < 75c8d1d7291268b479794fba5808971dc2f5eaf3 | 75c8d1d7291268b479794fba5808971dc2f5eaf3 |
| linux | linux | >= 9b54e248d2644be71cb394eb85f31ad99e023a05 < 505a3b94535583e4265360e2621734e355ef263d | 505a3b94535583e4265360e2621734e355ef263d |
| linux | linux | >= 9b54e248d2644be71cb394eb85f31ad99e023a05 < 121d88de56bc5c0ba0ce2f6381af67f948a7e7c1 | 121d88de56bc5c0ba0ce2f6381af67f948a7e7c1 |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-azure | — | — |
| ubuntu | linux-azure-fde | — | — |
| ubuntu | linux-ibm | — | — |
| ubuntu | linux-oracle | — | — |
| ubuntu | linux-raspi | — | — |
CVSS provenance
nvdv3.19.3CRITICALCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vendor_redhat9.3CRITICAL
vendor_ubuntu7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-28·CVSS 7.0
CVE-2026-64231 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 platform drivers;
- Cryptographic API;
- PSP security protocol;
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 archit
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-64107 [LOW] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 platfor
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.0
CVE-2026-64107 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 platform drivers;
- PSP security protocol;
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer
Red Hat
kernel: KVM: SEV: Check PSC request indices against the actual size of the buffer
vendor_redhat·2026-07-19·CVSS 9.3
CVE-2026-63938 [CRITICAL] CWE-1285 kernel: KVM: SEV: Check PSC request indices against the actual size of the buffer
kernel: KVM: SEV: Check PSC request indices against the actual size of the buffer
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) Secure Encrypted Virtualization (SEV) feature. When processing Page State Change (PSC) requests, the system does not properly validate the PSC buffer against the effective size of the scratch area. This can occur if a guest operating system provides a pointer that is not precisely at the start of the Guest Hypervisor Communication Block (GHCB) shared buffer, potentially leading to out-of-bounds memory access. This vulnerability could allow a malicious guest to cause a denial of service on the host system.
VulDB
Linux Kernel up to 6.12.92/6.18.34/7.0.11 KVM buffer overflow
vuldb·2026-07-19
CVE-2026-63938 Linux Kernel up to 6.12.92/6.18.34/7.0.11 KVM buffer overflow
A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.12.92/6.18.34/7.0.11. Affected by this issue is some unknown functionality of the component KVM. Executing a manipulation can lead to buffer overflow.
This vulnerability appears as CVE-2026-63938. The attack may be performed from remote. There is no available exploit.
GHSA
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change (PSC) requests, valida
ghsa_unreviewed·2026-07-19
CVE-2026-63938 [CRITICAL] In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change (PSC) requests, valida
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Check PSC request indices against the actual size of the buffer
When processing Page State Change (PSC) requests, validate the PSC buffer
against the effective size of the scratch area, which could be less than
the maximum size if the guest provided a pointer that isn't exactly at the
start of the GHCB shared buffer.
No detection rules found.
No public exploits indexed.
2026-07-19
Published