CVE-2026-63939

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-63939

Key Details

CVE	CVE-2026-63939
CVSS Score / Version	9.3 (Critical) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is none; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Compute the correct max length of the in-GHCB scratch area

When setting the length of the GHCB scratch area, and the area is in the

GHCB shared buffer, set the effective length of the scratch area to the max

possible size given the start of the guest-provided pointer, and the end of

the shared buffer.

The code was "fine" when first introduced, as KVM doesn't consult the

length of the buffer when emulating MMIO, because the passed in @len always

specifies the *max* size required. But for PSC requests, the incoming @len

is just the minimum length (to process the header), and KVM needs to know

the full size of the scratch area to avoid buffer overflows (spoiler alert).

Opportunistically rename @len => @min_len to better reflect its role. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-63939
CVE	https://www.cve.org/CVERecord?id=CVE-2026-63939

Source

Reference

NVD

CVE