{"id":"CVE-2026-63939","title":"kernel: KVM: SEV: Compute the correct max length of the in-GHCB scratch area (CVE-2026-63939)","summary":"A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) with Secure Encrypted Virtualization (SEV) support. This vulnerability arises from an incorrect calculation of the maximum length for the in-Guest-Host Communication…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-131","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 9"],"published":"2026-07-19","updated":"2026-10-16","sourceUpdated":"2026-10-16T23:10:39+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63939.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63939.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-63939"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502365"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63939"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63939"},{"url":"https://lore.kernel.org/linux-cve-announce/2026071952-CVE-2026-63939-8061@gregkh/T"},{"url":"https://git.kernel.org/stable/c/6ca9400d36005ffdca25f80186bea781c7e1dc4c"},{"url":"https://git.kernel.org/stable/c/9f0a9e780f02c02d025a190f1885e1d1d73b87bd"},{"url":"https://git.kernel.org/stable/c/6644565527c4c5f507088b1c9ddf72de47790b68"},{"url":"https://git.kernel.org/stable/c/5867d7e202e09f037cefe77f7af4413c7c0fa088"}],"tags":["csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.00212,"epssPercentile":0.10701,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:33:48.298824Z"},"scores":{"vendor":7,"cna":9.3},"ingestedAt":"2026-10-16T17:24:46.780Z","slug":"CVE-2026-63939","body":"## Overview\n\nA flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) with Secure Encrypted Virtualization (SEV) support. This vulnerability arises from an incorrect calculation of the maximum length for the in-Guest-Host Communication Block (GHCB) scratch area. When processing Page State Change (PSC) requests, KVM uses a minimum length instead of the full required size, which can lead to a buffer overflow. A malicious guest operating system could potentially exploit this to cause a denial of service or escalate privileges on the host system.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63939.json)\n\n**kernel: KVM: SEV: Compute the correct max length of the in-GHCB scratch area** — rated Important by Red Hat. Released 2026-07-19, updated 2026-10-16.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n\nNot affected:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n\n## Remediation\n\nAffected\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":223666,"id":"CVE-2026-63939","ts":1792238362758,"field":"cvss","old":"9.3","new":"7"},{"seq":223665,"id":"CVE-2026-63939","ts":1792238362758,"field":"severity","old":"critical","new":"high"}]}