Vulnerability-Lookup

CVE-2026-64285 (GCVE-0-2026-64285)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-07-25 08:49

Title

KVM: SEV: Pin source page for write when adding CPUID data for SNP guest

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guest_memfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the "correct" CPUID information if the userspace provided data is rejected by trusted firmware. Because KVM writes to the source page using a kernel mapping, pinning for read could result in KVM clobbering read-only memory. Note, well-behaved VMMs are unlikely to be affected, as CPUID information is almost always dynamically generated by userspace, i.e. it's unlikely for the CPUID information to be backed by a read-only mapping. [sean: rewrite shortlog and changelog, tag for stable@]

Severity

No CVSS data available.

Assigner

Linux

References

2 references

URL	Tags
https://git.kernel.org/stable/c/dcdb476f5fc5701ec…
https://git.kernel.org/stable/c/f13e900599089b101…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2a62345b30529e488beb6a1220577b3495933724 , < dcdb476f5fc5701ec06c23efe3e3529f07ca391e (git) Affected: 2a62345b30529e488beb6a1220577b3495933724 , < f13e900599089b10113ceb36013423f0837c6792 (git)
Linux	Linux	Affected: 7.0 Unaffected: 0 , < 7.0 (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c",
            "arch/x86/kvm/vmx/tdx.c",
            "include/linux/kvm_host.h",
            "virt/kvm/guest_memfd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dcdb476f5fc5701ec06c23efe3e3529f07ca391e",
              "status": "affected",
              "version": "2a62345b30529e488beb6a1220577b3495933724",
              "versionType": "git"
            },
            {
              "lessThan": "f13e900599089b10113ceb36013423f0837c6792",
              "status": "affected",
              "version": "2a62345b30529e488beb6a1220577b3495933724",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c",
            "arch/x86/kvm/vmx/tdx.c",
            "include/linux/kvm_host.h",
            "virt/kvm/guest_memfd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Pin source page for write when adding CPUID data for SNP guest\n\nWhen populating a guest_memfd instance with the initial CPUID data for an\nSNP guest, acquire a writable pin on the source page as KVM will write back\nthe \"correct\" CPUID information if the userspace provided data is rejected\nby trusted firmware.  Because KVM writes to the source page using a kernel\nmapping, pinning for read could result in KVM clobbering read-only memory.\n\nNote, well-behaved VMMs are unlikely to be affected, as CPUID information\nis almost always dynamically generated by userspace, i.e. it\u0027s unlikely for\nthe CPUID information to be backed by a read-only mapping.\n\n[sean: rewrite shortlog and changelog, tag for stable@]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-25T08:49:26.898Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dcdb476f5fc5701ec06c23efe3e3529f07ca391e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f13e900599089b10113ceb36013423f0837c6792"
        }
      ],
      "title": "KVM: SEV: Pin source page for write when adding CPUID data for SNP guest",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64285",
    "datePublished": "2026-07-25T08:49:26.898Z",
    "dateReserved": "2026-07-19T15:36:31.777Z",
    "dateUpdated": "2026-07-25T08:49:26.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64285",
      "date": "2026-07-26",
      "epss": "0.00189",
      "percentile": "0.08867"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64285\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:09.140\",\"lastModified\":\"2026-07-25T10:17:09.140\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: SEV: Pin source page for write when adding CPUID data for SNP guest\\n\\nWhen populating a guest_memfd instance with the initial CPUID data for an\\nSNP guest, acquire a writable pin on the source page as KVM will write back\\nthe \\\"correct\\\" CPUID information if the userspace provided data is rejected\\nby trusted firmware.  Because KVM writes to the source page using a kernel\\nmapping, pinning for read could result in KVM clobbering read-only memory.\\n\\nNote, well-behaved VMMs are unlikely to be affected, as CPUID information\\nis almost always dynamically generated by userspace, i.e. it\u0027s unlikely for\\nthe CPUID information to be backed by a read-only mapping.\\n\\n[sean: rewrite shortlog and changelog, tag for stable@]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/svm/sev.c\",\"arch/x86/kvm/vmx/tdx.c\",\"include/linux/kvm_host.h\",\"virt/kvm/guest_memfd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2a62345b30529e488beb6a1220577b3495933724\",\"lessThan\":\"dcdb476f5fc5701ec06c23efe3e3529f07ca391e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2a62345b30529e488beb6a1220577b3495933724\",\"lessThan\":\"f13e900599089b10113ceb36013423f0837c6792\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/svm/sev.c\",\"arch/x86/kvm/vmx/tdx.c\",\"include/linux/kvm_host.h\",\"virt/kvm/guest_memfd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/dcdb476f5fc5701ec06c23efe3e3529f07ca391e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f13e900599089b10113ceb36013423f0837c6792\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-27T08:17:04+00:00",
      "cve": "CVE-2026-64285",
      "id": "CVE-2026-64285",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "275",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64285.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-07-25T16:46:35Z",
      "cve": "CVE-2026-64285",
      "id": "CVE-2026-64285",
      "initial_release_date": "2026-07-25T16:46:35Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64285",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64285.json",
      "version": "2"
    }
  }
}

GHSA-9FRV-WMXV-XPWJ

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-25 12:31

Details

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Pin source page for write when adding CPUID data for SNP guest

When populating a guest_memfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the "correct" CPUID information if the userspace provided data is rejected by trusted firmware. Because KVM writes to the source page using a kernel mapping, pinning for read could result in KVM clobbering read-only memory.

Note, well-behaved VMMs are unlikely to be affected, as CPUID information is almost always dynamically generated by userspace, i.e. it's unlikely for the CPUID information to be backed by a read-only mapping.

[sean: rewrite shortlog and changelog, tag for stable@]

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-64285"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:09Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Pin source page for write when adding CPUID data for SNP guest\n\nWhen populating a guest_memfd instance with the initial CPUID data for an\nSNP guest, acquire a writable pin on the source page as KVM will write back\nthe \"correct\" CPUID information if the userspace provided data is rejected\nby trusted firmware.  Because KVM writes to the source page using a kernel\nmapping, pinning for read could result in KVM clobbering read-only memory.\n\nNote, well-behaved VMMs are unlikely to be affected, as CPUID information\nis almost always dynamically generated by userspace, i.e. it\u0027s unlikely for\nthe CPUID information to be backed by a read-only mapping.\n\n[sean: rewrite shortlog and changelog, tag for stable@]",
  "id": "GHSA-9frv-wmxv-xpwj",
  "modified": "2026-07-25T12:31:29Z",
  "published": "2026-07-25T12:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64285"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dcdb476f5fc5701ec06c23efe3e3529f07ca391e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f13e900599089b10113ceb36013423f0837c6792"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-64285 (GCVE-0-2026-64285)

GHSA-9FRV-WMXV-XPWJ

Tags

Sightings

Nomenclature