CVE-2026-63937KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Use READ_ONCE() when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READ_ONCE()/WRITE_ONCE() for cases where KVM is writing (and not consuming the result!), as the guest isn't supposed to touch the buffer while it's being processed. I.e. using READ_ONCE() is all about protecting against misbehaving guests.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 9b54e248d2644be71cb394eb85f31ad99e023a05 before bd232801ef1d1fd985d2d4ca3cd1d888303ca86f; from 9b54e248d2644be71cb394eb85f31ad99e023a05 before b1dfaa6f7a957726a6800135be3659fbe4bbf2a4; from 9b54e248d2644be71cb394eb85f31ad99e023a05 before edbbe88f83b524434974e84808d3093199d67c24; from 9b54e248d2644be71cb394eb85f31ad99e023a05 before c8cc238093ca6c99267032f6cfe78f59389f3157 | CNA record |
References
- https://git.kernel.org/stable/c/bd232801ef1d1fd985d2d4ca3cd1d888303ca86f
- https://git.kernel.org/stable/c/b1dfaa6f7a957726a6800135be3659fbe4bbf2a4
- https://git.kernel.org/stable/c/edbbe88f83b524434974e84808d3093199d67c24
- https://git.kernel.org/stable/c/c8cc238093ca6c99267032f6cfe78f59389f3157
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.