CVE-2026-53360

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use

As per the GHCB spec, when using GHCB v2+ require the software scratch area

to reside in the GHCB's shared buffer. Note, things like Page State Change

(PSC) requests _rely_ on this behavior, as the guest can't provide a length

when making the request, i.e. the size of the guest payload is bounded by

the size of the shared buffer.

Failure to force usage of the GHCB, and a slew of other flaws, lets a

malicious SNP guest corrupt host kernel heap memory, and leak host heap

layout information.

setup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2),

where exit_info_2 is guest-controlled. With exit_info_2=24, this yields

a 24-byte allocation in kmalloc-cg-32 (32-byte slab objects). The buffer

holds an 8-byte psc_hdr followed by 8-byte psc_entry structs, so only

entries[0] and entries[1] are in-bounds.

snp_begin_psc() validates end_entry against V

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References