CVE-2026-52959

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the sev-guest component when issuing an extended guest request (SVM VMGEXIT EXT GUEST REQUEST). The get ext report() function allocates a buffer to retrieve a certificate blob from the host and tracks its size using the report req->certs len variable. If the host returns a SNP GUEST VMM ERR INVALID LEN error, it may provide an expected buffer length that updates report req->certs len. The system then uses this host-controlled value to compute a page order for buffer cleanup. Because the host-provided length might not match the original allocation's page order, this can lead to corruption in the page allocator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.