Log in Start free

Vulnerability · Published Jul 19, 2026 · Assigned by Linux

CVE-2026-63939KVM: SEV: Compute the correct max length of the in-GHCB scratch area

Critical 9.3

In plain English

A critical-severity heap buffer overflow in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.2%top 90.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible size given the start of the guest-provided pointer, and the end of the shared buffer. The code was "fine" when first introduced, as KVM doesn't consult the length of the buffer when emulating MMIO, because the passed in @len always specifies the *max* size required. But for PSC requests, the incoming @len is just the minimum length (to process the header), and KVM needs to know the full size of the scratch area to avoid buffer overflows (spoiler alert). Opportunistically rename @len => @min_len to better reflect its role.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.94-1DEBIAN-CVE-2026-63939
Debian:14linux7.0.12-1DEBIAN-CVE-2026-63939
Ubuntu:26.04:LTSlinux7.0.0-28.28UBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-63939
Ubuntu:26.04:LTSlinux-aws7.0.0-1009.9UBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-63939
Ubuntu:26.04:LTSlinux-azure7.0.0-1010.10UBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-azure-7.07.0.0-1014.14~24.04.1UBUNTU-CVE-2026-63939
Ubuntu:26.04:LTSlinux-azure-fde7.0.0-1009.9UBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-azure-fde-7.07.0.0-1013.13~24.04.1UBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-63939
Ubuntu:26.04:LTSlinux-gcp7.0.0-1008.8UBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-gcp-7.07.0.0-1011.11~24.04.1UBUNTU-CVE-2026-63939
Ubuntu:26.04:LTSlinux-gke7.0.0-1003.4UBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-28.28~24.04.1UBUNTU-CVE-2026-63939
Ubuntu:26.04:LTSlinux-ibm7.0.0-1010.10UBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-63939
Ubuntu:26.04:LTSlinux-nvidia7.0.0-1016.16UBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-nvidia-7.07.0.0-1016.16~24.04.1UBUNTU-CVE-2026-63939
Ubuntu:26.04:LTSlinux-nvidia-bos7.0.0-2016.16UBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-63939
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1009.9UBUNTU-CVE-2026-63939
Ubuntu:26.04:LTSlinux-oracle7.0.0-1008.8UBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-oracle-7.07.0.0-1011.11~24.04.1UBUNTU-CVE-2026-63939
Ubuntu:26.04:LTSlinux-raspi7.0.0-1015.15UBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-63939
Ubuntu:26.04:LTSlinux-realtime7.0.0-28.28.1UBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-63939
Ubuntu:26.04:LTSlinux-riscv7.0.0-28.28.1UBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-63939
Ubuntu:24.04:LTSlinux-riscv-7.07.0.0-28.28.1~24.04.3UBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-63939
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-63939

Affected products (as reported)

VendorProductVersions
Linux Linux 9b54e248d2644be71cb394eb85f31ad99e023a05 – before 6ca9400d36005ffdca25f80186bea781c7e1dc4c9b54e248d2644be71cb394eb85f31ad99e023a05 – before 9f0a9e780f02c02d025a190f1885e1d1d73b87bd9b54e248d2644be71cb394eb85f31ad99e023a05 – before 6644565527c4c5f507088b1c9ddf72de47790b689b54e248d2644be71cb394eb85f31ad99e023a05 – before 5867d7e202e09f037cefe77f7af4413c7c0fa088
Linux Linux 6.11

Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References