---
id: CVE-2026-63937
title: 'KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer

  Use READ_ONCE() when reading entries/indices from the guest-accessible
  Page State Change buffer …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 <
    bd232801ef1d1fd985d2d4ca3cd1d888303ca86f
  - >-
    Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 <
    b1dfaa6f7a957726a6800135be3659fbe4bbf2a4
  - >-
    Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 <
    edbbe88f83b524434974e84808d3093199d67c24
  - >-
    Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 <
    c8cc238093ca6c99267032f6cfe78f59389f3157
  - Linux 6.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:33:43.123685Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:12.937Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63937'
references:
  - url: 'https://git.kernel.org/stable/c/bd232801ef1d1fd985d2d4ca3cd1d888303ca86f'
  - url: 'https://git.kernel.org/stable/c/b1dfaa6f7a957726a6800135be3659fbe4bbf2a4'
  - url: 'https://git.kernel.org/stable/c/edbbe88f83b524434974e84808d3093199d67c24'
  - url: 'https://git.kernel.org/stable/c/c8cc238093ca6c99267032f6cfe78f59389f3157'
tags:
  - cve.org
epss: 0.00175
epssPercentile: 0.06548
ingestedAt: '2026-10-16T17:24:46.779Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer

Use READ_ONCE() when reading entries/indices from the guest-accessible
Page State Change buffer to defend against TOCTOU bugs.

Don't bother with READ_ONCE()/WRITE_ONCE() for cases where KVM is writing
(and not consuming the result!), as the guest isn't supposed to touch the
buffer while it's being processed.  I.e. using READ_ONCE() is all about
protecting against misbehaving guests.

## Affected

- `Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 < bd232801ef1d1fd985d2d4ca3cd1d888303ca86f`
- `Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 < b1dfaa6f7a957726a6800135be3659fbe4bbf2a4`
- `Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 < edbbe88f83b524434974e84808d3093199d67c24`
- `Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 < c8cc238093ca6c99267032f6cfe78f59389f3157`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.