CVE-2026-63940 (GCVE-0-2026-63940)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
Title
KVM: SEV: Ignore Port I/O requests of length '0'
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.
Severity
9.3 (Critical)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 291bd20d5d88814a73d43b55b9428feab2f28094 , < 3b6035bc6bff20e89752ce4358bc4c9a9d5883f2 (git)
Affected: 291bd20d5d88814a73d43b55b9428feab2f28094 , < 2254972d4d69e279ba4e87bf0968eb08ad0d3c92 (git)
Affected: 291bd20d5d88814a73d43b55b9428feab2f28094 , < c30cde934c7813b4e3069765dac64ce3d31e34f2 (git)
Affected: 291bd20d5d88814a73d43b55b9428feab2f28094 , < 3988bd2723de407ae90fa7a6f6029b4e60238c58 (git)
Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3b6035bc6bff20e89752ce4358bc4c9a9d5883f2",
              "status": "affected",
              "version": "291bd20d5d88814a73d43b55b9428feab2f28094",
              "versionType": "git"
            },
            {
              "lessThan": "2254972d4d69e279ba4e87bf0968eb08ad0d3c92",
              "status": "affected",
              "version": "291bd20d5d88814a73d43b55b9428feab2f28094",
              "versionType": "git"
            },
            {
              "lessThan": "c30cde934c7813b4e3069765dac64ce3d31e34f2",
              "status": "affected",
              "version": "291bd20d5d88814a73d43b55b9428feab2f28094",
              "versionType": "git"
            },
            {
              "lessThan": "3988bd2723de407ae90fa7a6f6029b4e60238c58",
              "status": "affected",
              "version": "291bd20d5d88814a73d43b55b9428feab2f28094",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Ignore Port I/O requests of length \u00270\u0027\n\nExplicitly ignore Port I/O requests of length \u00270\u0027 (or count \u00270\u0027), so that\nsetting up the software scratch area (and other code) doesn\u0027t have to\nworry about underflowing the length, and to allow for WARNing on trying\nto configure the scratch area with len==0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached when a SEV-ES/SEV-SNP guest triggers a #VMGEXIT with a crafted GHCB Port I/O request; exploitation requires executing code inside a guest VM on the host, not remote network delivery.\nAC:L - A guest can reliably set GHCB exit_info_1 size to 0 (or count to 0) and issue string Port I/O via VMGEXIT without races or special host state; success does not depend on conditions outside attacker control.\nPR:N - The attacker needs no privileges on the host kernel\u2014only code execution inside an SEV-ES guest VM, which is the normal capability of a cloud confidential-VM tenant with no elevated host access.\nUI:N - Exploitation is fully attacker-driven from guest code via VMGEXIT; no host administrator or other user action is required.\nS:C - The vulnerable component is the host KVM hypervisor, but exploitation is initiated from a guest VM and impacts host kernel integrity/availability, crossing the guest/host security boundary.\nC:H - Allowing zero-length scratch setup sets ghcb_sa_len to 0, enabling unsigned length underflow in scratch-area size arithmetic; combined with ZERO_SIZE_PTR from kvzalloc(0), this is a memory-safety defect class that can yield out-of-bounds read primitives.\nI:H - Zero-length scratch configuration corrupts length tracking used by subsequent GHCB scratch handling, creating integer-underflow conditions that can lead to out-of-bounds writes; the divide-by-zero path also demonstrates uncontrolled host kernel failure from guest input.\nA:H - A malicious guest can reliably panic the host kernel via divide-by-zero in kvm_sev_es_string_io() when size is 0 and count is non-zero, causing complete loss of hypervisor availability for all co-hosted workloads."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:27.732Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3b6035bc6bff20e89752ce4358bc4c9a9d5883f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/2254972d4d69e279ba4e87bf0968eb08ad0d3c92"
        },
        {
          "url": "https://git.kernel.org/stable/c/c30cde934c7813b4e3069765dac64ce3d31e34f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/3988bd2723de407ae90fa7a6f6029b4e60238c58"
        }
      ],
      "title": "KVM: SEV: Ignore Port I/O requests of length \u00270\u0027",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63940",
    "datePublished": "2026-07-19T14:55:36.408Z",
    "dateReserved": "2026-07-19T07:54:57.022Z",
    "dateUpdated": "2026-08-05T12:37:27.732Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63940",
      "date": "2026-08-11",
      "epss": "0.0018",
      "percentile": "0.07792"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-21T01:03:02.000Z",
      "cve": "CVE-2026-63940",
      "id": "msrc_CVE-2026-63940",
      "initial_release_date": "2026-07-21T01:03:02.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "KVM: SEV: Ignore Port I/O requests of length \u00270\u0027",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63940.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63940\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:12.540\",\"lastModified\":\"2026-07-27T17:44:23.777\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: SEV: Ignore Port I/O requests of length \u00270\u0027\\n\\nExplicitly ignore Port I/O requests of length \u00270\u0027 (or count \u00270\u0027), so that\\nsetting up the software scratch area (and other code) doesn\u0027t have to\\nworry about underflowing the length, and to allow for WARNing on trying\\nto configure the scratch area with len==0.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/svm/sev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"291bd20d5d88814a73d43b55b9428feab2f28094\",\"lessThan\":\"3b6035bc6bff20e89752ce4358bc4c9a9d5883f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"291bd20d5d88814a73d43b55b9428feab2f28094\",\"lessThan\":\"2254972d4d69e279ba4e87bf0968eb08ad0d3c92\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"291bd20d5d88814a73d43b55b9428feab2f28094\",\"lessThan\":\"c30cde934c7813b4e3069765dac64ce3d31e34f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"291bd20d5d88814a73d43b55b9428feab2f28094\",\"lessThan\":\"3988bd2723de407ae90fa7a6f6029b4e60238c58\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/svm/sev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.95\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.35\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2254972d4d69e279ba4e87bf0968eb08ad0d3c92\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3988bd2723de407ae90fa7a6f6029b4e60238c58\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3b6035bc6bff20e89752ce4358bc4c9a9d5883f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c30cde934c7813b4e3069765dac64ce3d31e34f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:21:14+00:00",
      "cve": "CVE-2026-63940",
      "id": "CVE-2026-63940",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: SEV: Ignore Port I/O requests of length \u00270\u0027",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63940.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-10T16:25:08Z",
      "cve": "CVE-2026-63940",
      "id": "CVE-2026-63940",
      "initial_release_date": "2026-07-21T13:03:06Z",
      "product_status:first_fixed": "98",
      "product_status:known_affected": "118",
      "product_status:known_not_affected": "166",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63940",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63940.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.