CVE-2026-80853

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts

When {de,en}crypting memory of an SEV or SEV-ES guest on an SNP-enabled

host via a temporary buffer, allocate a full 4KiB page for the buffer to

ensure the page containing the buffer is wholly owned by KVM, i.e. won't

be concurrently allocated and accessed by other kernel code while KVM is

using the buffer to {de,en}crypt memory. On SNP-enabled platforms, when

sending SEV/SEV-ES commands that trigger firmware writes to memory, the

to-be-written page(s) must be (temporarily) assigned to Firmware (as

required by the SNP architecture, to guard against using such commands as

gadgets to attack SNP guests). See snp_map_cmd_buf_desc() and friends.

Unfortunately, transferring ownership of a page to Firmware makes the page

inaccessible to software, and thus writes generate RMP #PF violations. If

KVM uses a sub-page allocation for its temporary buffer,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References