7.8
/ 10
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
In the Linux kernel, the following vulnerability has been resolved:
virt: sev-guest: Do not use host-controlled page order in cleanup path
When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST),
get_ext_report() allocates a buffer to retrieve a certificate blob from the
host, keeping track of its size in report_req->certs_len.
However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating
an invalid buffer size, as well as the expected length of such buffer.
get_ext_report() subsequently updates report_req->certs_len with the
host-controlled value, and cleans up the buffer by computing a page order
from such value. This is incorrect, as the host-provided length may not
match the page order of the original allocation, potentially resulting
in corruption in the page allocator.
Fix this by using alloc_pages_exact() instead, and reusing @npages to
compute the size passed to free_pages_exact(). For consistency, also
use @npages to compute the size when allocating the pages, even though
this last change has no functional effect.
virt: sev-guest: Do not use host-controlled page order in cleanup path
When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST),
get_ext_report() allocates a buffer to retrieve a certificate blob from the
host, keeping track of its size in report_req->certs_len.
However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating
an invalid buffer size, as well as the expected length of such buffer.
get_ext_report() subsequently updates report_req->certs_len with the
host-controlled value, and cleans up the buffer by computing a page order
from such value. This is incorrect, as the host-provided length may not
match the page order of the original allocation, potentially resulting
in corruption in the page allocator.
Fix this by using alloc_pages_exact() instead, and reusing @npages to
compute the size passed to free_pages_exact(). For consistency, also
use @npages to compute the size when allocating the pages, even though
this last change has no functional effect.
Basic Information
ID
CVE-2026-52959
Source
Linux
Published
Jun 24, 2026 at 16:28
Modified
Jun 28, 2026 at 06:37
Affected Product
Vendor
Linux
Product
Linux
Version
3e385c0d6ce88ac9916dcf84267bd5855d830748
Affected Versions
Linux Linux 3e385c0d6ce88ac9916dcf84267bd5855d830748
Linux Linux 3e385c0d6ce88ac9916dcf84267bd5855d830748
Linux Linux 3e385c0d6ce88ac9916dcf84267bd5855d830748
Linux Linux 0b16521f95c875e79d657cb8d6911c15080dbb80
Linux Linux 6.13.8
Linux Linux 6.14
Linux Linux 3e385c0d6ce88ac9916dcf84267bd5855d830748
Linux Linux 3e385c0d6ce88ac9916dcf84267bd5855d830748
Linux Linux 0b16521f95c875e79d657cb8d6911c15080dbb80
Linux Linux 6.13.8
Linux Linux 6.14