CVE-2026-52959

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

virt: sev-guest: Do not use host-controlled page order in cleanup path

When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST),

get_ext_report() allocates a buffer to retrieve a certificate blob from the

host, keeping track of its size in report_req->certs_len.

However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating

an invalid buffer size, as well as the expected length of such buffer.

get_ext_report() subsequently updates report_req->certs_len with the

host-controlled value, and cleans up the buffer by computing a page order

from such value. This is incorrect, as the host-provided length may not

match the page order of the original allocation, potentially resulting

in corruption in the page allocator.

Fix this by using alloc_pages_exact() instead, and reusing @npages to

compute the size passed to free_pages_exact(). For consistency, also

use @npages to compute the size when allocating

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References