{"id":"CVE-2026-52959","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: sev-guest: Do not use host-controlled page order in cleanup path\n\nWhen issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST),\nget_ext_report() allocat…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: sev-guest: Do not use host-controlled page order in cleanup path\n\nWhen issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST),\nget_ext_report() allocat…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","published":"2026-06-24","updated":"2026-07-10","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52959","references":[{"url":"https://git.kernel.org/stable/c/23e6a1ca04ae44806439a5a446e62e4d42e80bb4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3f6fb0211b39aaa1b841260681dd02ca6b693ed5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e48b4f813d2c3db75d522aa82ab705ce04b7e2d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00093,"epssPercentile":0.00617,"ingestedAt":"2026-07-11T13:13:24.921Z","slug":"CVE-2026-52959","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvirt: sev-guest: Do not use host-controlled page order in cleanup path\n\nWhen issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST),\nget_ext_report() allocates a buffer to retrieve a certificate blob from the\nhost, keeping track of its size in report_req->certs_len.\n\nHowever, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating\nan invalid buffer size, as well as the expected length of such buffer.\nget_ext_report() subsequently updates report_req->certs_len with the\nhost-controlled value, and cleans up the buffer by computing a page order\nfrom such value. This is incorrect, as the host-provided length may not\nmatch the page order of the original allocation, potentially resulting\nin corruption in the page allocator.\n\nFix this by using alloc_pages_exact() instead, and reusing @npages to\ncompute the size passed to free_pages_exact(). For consistency, also\nuse @npages to compute the size when allocating the pages, even though\nthis last change has no functional effect.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}