CVE-2026-63938
A flaw in the Linux kernel's KVM SEV component fails to properly validate Page State Change (PSC) request indices against the actual buffer size. This could allow an attacker with local access to trigger out-of-bounds memory accesses, potentially leading to confidentiality, integrity, and availability impacts. The issue has been marked as resolved in the kernel source.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running KVM with AMD SEV-enabled virtual machines.
Real-world impact
Successful exploitation could allow a local attacker to read, modify, or crash kernel memory, compromising the host system.
Why this severity
CVSS v3.1 base score 9.3 (Critical) due to high impacts on confidentiality, integrity, and availability with low attack complexity and no privileges or user interaction required.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for CVE-2026-63938 (the patch that validates PSC request indices against the actual buffer size).
- 02Reboot the system or restart the affected KVM service after the kernel update to ensure the patched code is active.
NVD-referenced vendor advisory (the NVD description states the vulnerability has been resolved in the Linux kernel).
Timeline
- Jul 19, 2026 · 14d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 27, 2026 · 6d agoAdvisory updatedThe NVD record was last revised.