CVE-2026-63794

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In sev_dbg_crypt(), the per-iteration transfer length is bounded by the source page offset (PAGE_SIZE - s_off) but not by the destination page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt path (__sev_dbg_encrypt_user) performs a read-modify-write using a single-page intermediate buffer (dst_tpage): 1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off & 15), 16) before issuing the PSP command. If len + (d_off & 15) > PAGE_SIZE, the PSP...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 24f41fb23a39bc2b6f190dcef35a5813a4bf183a < f701ae476cb92a3a3d8844bb39bb63b4512684c8, >= 24f41fb23a39bc2b6f190dcef35a5813a4bf183a < 64f2449841ffc7d203183aa4c748c9c77951ecc5, >= 24f41fb23a39bc2b6f190dcef35a5813a4bf183a < 9349b50f4b11f135fe73b56cb2c2c872d8bc71d7, >= 24f41fb23a39bc2b6f190dcef35a5813a4bf183a < 889c2a9c59897ca912bf39df5bb92555a0a13df4, >= 24f41fb23a39bc2b6f190dcef35a5813a4bf183a < e1a0fe288dee07b7da25a71e007c1ecd1080315b, >= 24f41fb23a39bc2b6f190dcef35a5813a4bf183a < 720949ed666f34ff28ffdfe1471a5861d1e41fdf, >= 24f41fb23a39bc2b6f190dcef35a5813a4bf183a < 2753a097d1fe24c4351c608048612c74108aa89f, >= 24f41fb23a39bc2b6f190dcef35a5813a4bf183a < 78ee2d50185a037b3d2452a97f3dad69c3f7f389, >= 4.16, >= 4.16 < 5.10.260, >= 5.11 < 5.15.211, >= 5.16 < 6.1.177, >= 6.2 < 6.6.144, >= 6.7 < 6.12.95, >= 6.13 < 6.18.38, >= 6.19 < 7.1.3

Fixed versions

5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787