---
id: CVE-2026-63938
title: 'KVM: SEV: Check PSC request indices against the actual size of the buffer'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: SEV: Check PSC request indices against the actual size of the buffer

  When processing Page State Change (PSC) requests, validate the PSC buffer
  against the effecti…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 <
    5198f70c09a5f6e9e5f5a0a2c6b388f24294b176
  - >-
    Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 <
    75c8d1d7291268b479794fba5808971dc2f5eaf3
  - >-
    Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 <
    505a3b94535583e4265360e2621734e355ef263d
  - >-
    Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 <
    121d88de56bc5c0ba0ce2f6381af67f948a7e7c1
  - Linux 6.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:33:45.611470Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:13.106Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63938'
references:
  - url: 'https://git.kernel.org/stable/c/5198f70c09a5f6e9e5f5a0a2c6b388f24294b176'
  - url: 'https://git.kernel.org/stable/c/75c8d1d7291268b479794fba5808971dc2f5eaf3'
  - url: 'https://git.kernel.org/stable/c/505a3b94535583e4265360e2621734e355ef263d'
  - url: 'https://git.kernel.org/stable/c/121d88de56bc5c0ba0ce2f6381af67f948a7e7c1'
tags:
  - cve.org
epss: 0.00196
epssPercentile: 0.08645
ingestedAt: '2026-10-16T17:24:46.780Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Check PSC request indices against the actual size of the buffer

When processing Page State Change (PSC) requests, validate the PSC buffer
against the effective size of the scratch area, which could be less than
the maximum size if the guest provided a pointer that isn't exactly at the
start of the GHCB shared buffer.

## Affected

- `Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 < 5198f70c09a5f6e9e5f5a0a2c6b388f24294b176`
- `Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 < 75c8d1d7291268b479794fba5808971dc2f5eaf3`
- `Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 < 505a3b94535583e4265360e2621734e355ef263d`
- `Linux >= 9b54e248d2644be71cb394eb85f31ad99e023a05 < 121d88de56bc5c0ba0ce2f6381af67f948a7e7c1`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.