CVE-2026-63794

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.0

Description A page overflow exists in the Linux kernel KVM SVM implementation within the sev dbg crypt() function during the encryption path. The issue occurs because the per-iteration transfer length is bounded by the source page offset but not by the destination page offset. When the destination offset d off is greater than the source offset s off, the sev dbg encrypt user path performs a read-modify-write using a single-page intermediate buffer dst tpage. Specifically, the sev dbg decrypt() function expands the size before issuing the PSP command; if the resulting length exceeds the page size, the PSP writes beyond the 4096-byte allocation of dst tpage. Additionally, subsequent memcpy() or copy from user() operations into the buffer can overflow by up to 15 bytes. This can lead to a slab-use-after-free condition in the kvm amd module.

Recommendations Update the Linux kernel to version 7.0.0 or later to resolve the page overflow in the AMD SEV hypervisor.