CVE-2026-53360

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM SEV subsystem where the setup vmgexit scratch() function allocates a buffer using kvzalloc() based on a guest-controlled variable exit info 2. The snp begin psc() function fails to validate the end entry variable against the actual buffer size, checking it only against a maximum constant. This allows a malicious SEV-SNP guest to trigger out-of-bounds (OOB) reads and writes in the host kernel heap memory (specifically kmalloc-cg-32 slab objects). By manipulating exit info 2 and the entry range (cur entry/end entry), an attacker can leak host heap layout information, corrupt host kernel heap memory, or trigger use-after-free conditions. This can be achieved by sending unlimited VMGEXIT requests to target different slab positions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.