CVE-2026-63794
KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In sev_dbg_crypt(), the per-iteration transfer length is bounded by the source page offset (PAGE_SIZE - s_off) but not by the destination page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt path (__sev_dbg_encrypt_user) performs a read-modify-write using a single-page intermediate buffer (dst_tpage): 1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off & 15), 16) before issuing the PSP command. If len + (d_off & 15) > PAGE_SIZE, the PSP writes beyond the end of the 4096-byte dst_tpage allocation. 2. The subsequent memcpy()/copy_from_user() into page_address(dst_tpage) + (d_off & 15) of 'len' bytes overflows by up to 15 bytes under the same condition. Trigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE - the PSP is instructed to write round_up(4097, 16) = 4112 bytes to a 4096-byte buffer. Fix by also bounding len by (PAGE_SIZE - d_off), the same check that sev_send_update_data() already performs for its single-page guest region. ================================================================== BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd] Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214 CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY Tainted: [U]=USER, [W]=WARN Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025 Call Trace: <TASK> dump_stack_lvl+0x54/0x70 print_report+0xbc/0x260 kasan_report+0xa2/0xd0 kasan_check_range+0x25f/0x2c0 __asan_memcpy+0x40/0x70 sev_dbg_crypt+0x993/0xd10 [kvm_amd] sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd] kvm_vm_ioctl+0x65d/0x6d0 [kvm] __se_sys_ioctl+0xb2/0x100 do_syscall_64+0xe8/0x870 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb memcg:ff11000112827d82 flags: 0x1400000000000000(node=1|zone=1) raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000 raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82 page dumped because: kasan: bad access detected Memory state around the buggy address: ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ================================================================== Disabling lock debugging due to kernel taint [sean: add sample KASAN splat, Fixes, and stable@]
INFO
Published Date :
July 19, 2026, 12:16 p.m.
Last Modified :
Aug. 17, 2026, 5:17 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update the Linux kernel to the latest version.
- Apply the provided patch to fix the sev_dbg_crypt function.
- Ensure the destination page offset is checked.
- Limit transfer length by destination offset.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-63794.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-63794 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-63794
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63794 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-63794 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': 'f701ae476cb92a3a3d8844bb39bb63b4512684c8', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '64f2449841ffc7d203183aa4c748c9c77951ecc5', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '9349b50f4b11f135fe73b56cb2c2c872d8bc71d7', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '889c2a9c59897ca912bf39df5bb92555a0a13df4', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': 'e1a0fe288dee07b7da25a71e007c1ecd1080315b', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '720949ed666f34ff28ffdfe1471a5861d1e41fdf', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '2753a097d1fe24c4351c608048612c74108aa89f', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '78ee2d50185a037b3d2452a97f3dad69c3f7f389', 'versionType': 'git'}], 'programFiles': ['arch/x86/kvm/svm/sev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.38', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.3', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/x86/kvm/svm/sev.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': 'f701ae476cb92a3a3d8844bb39bb63b4512684c8', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '64f2449841ffc7d203183aa4c748c9c77951ecc5', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '9349b50f4b11f135fe73b56cb2c2c872d8bc71d7', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '889c2a9c59897ca912bf39df5bb92555a0a13df4', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': 'e1a0fe288dee07b7da25a71e007c1ecd1080315b', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '720949ed666f34ff28ffdfe1471a5861d1e41fdf', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '2753a097d1fe24c4351c608048612c74108aa89f', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '78ee2d50185a037b3d2452a97f3dad69c3f7f389', 'versionType': 'git'}], 'programFiles': ['arch/x86/kvm/svm/sev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.38', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.3', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/x86/kvm/svm/sev.c'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
Jul. 30, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-787 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.177 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.144 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.95 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.211 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.38 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.1.3 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.16 up to (excluding) 5.10.260 Added Reference Type kernel.org: https://git.kernel.org/stable/c/2753a097d1fe24c4351c608048612c74108aa89f Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/64f2449841ffc7d203183aa4c748c9c77951ecc5 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/720949ed666f34ff28ffdfe1471a5861d1e41fdf Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/78ee2d50185a037b3d2452a97f3dad69c3f7f389 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/889c2a9c59897ca912bf39df5bb92555a0a13df4 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9349b50f4b11f135fe73b56cb2c2c872d8bc71d7 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e1a0fe288dee07b7da25a71e007c1ecd1080315b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f701ae476cb92a3a3d8844bb39bb63b4512684c8 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': 'f701ae476cb92a3a3d8844bb39bb63b4512684c8', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '64f2449841ffc7d203183aa4c748c9c77951ecc5', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '9349b50f4b11f135fe73b56cb2c2c872d8bc71d7', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '889c2a9c59897ca912bf39df5bb92555a0a13df4', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': 'e1a0fe288dee07b7da25a71e007c1ecd1080315b', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '720949ed666f34ff28ffdfe1471a5861d1e41fdf', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '2753a097d1fe24c4351c608048612c74108aa89f', 'versionType': 'git'}, {'status': 'affected', 'version': '24f41fb23a39bc2b6f190dcef35a5813a4bf183a', 'lessThan': '78ee2d50185a037b3d2452a97f3dad69c3f7f389', 'versionType': 'git'}], 'programFiles': ['arch/x86/kvm/svm/sev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.38', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.3', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/x86/kvm/svm/sev.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In sev_dbg_crypt(), the per-iteration transfer length is bounded by the source page offset (PAGE_SIZE - s_off) but not by the destination page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt path (__sev_dbg_encrypt_user) performs a read-modify-write using a single-page intermediate buffer (dst_tpage): 1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off & 15), 16) before issuing the PSP command. If len + (d_off & 15) > PAGE_SIZE, the PSP writes beyond the end of the 4096-byte dst_tpage allocation. 2. The subsequent memcpy()/copy_from_user() into page_address(dst_tpage) + (d_off & 15) of 'len' bytes overflows by up to 15 bytes under the same condition. Trigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE - the PSP is instructed to write round_up(4097, 16) = 4112 bytes to a 4096-byte buffer. Fix by also bounding len by (PAGE_SIZE - d_off), the same check that sev_send_update_data() already performs for its single-page guest region. ================================================================== BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd] Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214 CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY Tainted: [U]=USER, [W]=WARN Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025 Call Trace: <TASK> dump_stack_lvl+0x54/0x70 print_report+0xbc/0x260 kasan_report+0xa2/0xd0 kasan_check_range+0x25f/0x2c0 __asan_memcpy+0x40/0x70 sev_dbg_crypt+0x993/0xd10 [kvm_amd] sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd] kvm_vm_ioctl+0x65d/0x6d0 [kvm] __se_sys_ioctl+0xb2/0x100 do_syscall_64+0xe8/0x870 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb memcg:ff11000112827d82 flags: 0x1400000000000000(node=1|zone=1) raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000 raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82 page dumped because: kasan: bad access detected Memory state around the buggy address: ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ================================================================== Disabling lock debugging due to kernel taint [sean: add sample KASAN splat, Fixes, and stable@] Added Reference https://git.kernel.org/stable/c/2753a097d1fe24c4351c608048612c74108aa89f Added Reference https://git.kernel.org/stable/c/64f2449841ffc7d203183aa4c748c9c77951ecc5 Added Reference https://git.kernel.org/stable/c/720949ed666f34ff28ffdfe1471a5861d1e41fdf Added Reference https://git.kernel.org/stable/c/78ee2d50185a037b3d2452a97f3dad69c3f7f389 Added Reference https://git.kernel.org/stable/c/889c2a9c59897ca912bf39df5bb92555a0a13df4 Added Reference https://git.kernel.org/stable/c/9349b50f4b11f135fe73b56cb2c2c872d8bc71d7 Added Reference https://git.kernel.org/stable/c/e1a0fe288dee07b7da25a71e007c1ecd1080315b Added Reference https://git.kernel.org/stable/c/f701ae476cb92a3a3d8844bb39bb63b4512684c8