CVE-2026-63794

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path

In sev_dbg_crypt(), the per-iteration transfer length is bounded by

the source page offset (PAGE_SIZE - s_off) but not by the destination

page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt

path (__sev_dbg_encrypt_user) performs a read-modify-write using a

single-page intermediate buffer (dst_tpage):

1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off & 15), 16)

before issuing the PSP command. If len + (d_off & 15) > PAGE_SIZE,

the PSP writes beyond the end of the 4096-byte dst_tpage allocation.

2. The subsequent memcpy()/copy_from_user() into

page_address(dst_tpage) + (d_off & 15) of 'len' bytes overflows

by up to 15 bytes under the same condition.

Trigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE -

the PSP is instructed to write round_up(4097, 16) = 4112 bytes to

a 4096-byte buffer.

Fix

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References