CVE-2026-52959: virt: sev-guest: Do not use host-controlled page order in cleanup path
In the Linux kernel, the following vulnerability has been resolved:
virt: sev-guest: Do not use host-controlled page order in cleanup path
When issuing an extended guest request (SVMVMGEXITEXTGUESTREQUEST), getextreport() allocates a buffer to retrieve a certificate blob from the host, keeping track of its size in reportreq->certslen.
However, the host may return SNPGUESTVMMERRINVALIDLEN, indicating an invalid buffer size, as well as the expected length of such buffer. getextreport() subsequently updates reportreq->certslen with the host-controlled value, and cleans up the buffer by computing a page order from such value. This is incorrect, as the host-provided length may not match the page order of the original allocation, potentially resulting in corruption in the page allocator.
Fix this by using allocpagesexact() instead, and reusing @npages to compute the size passed to freepagesexact(). For consistency, also use @npages to compute the size when allocating the pages, even though this last change has no functional effect.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In virt: sev-guest cleanup path, avoid using any host-controlled page order. Use @npages (the allocation-derived page count) to compute the size passed to free_pages_exact()/free_pages_exact()-equivalent cleanup instead of using host-provided length-derived page order.
Linux kernel virt: sev-guest cleanup path page order calculation = Do not use host-controlled page order - Configuration
In get_ext_report(), allocate the certificate blob buffer using alloc_pages_exact() and reuse @npages to compute the correct size for the allocation and corresponding free_pages_exact() cleanup, ensuring the freed size matches the original allocation.
Linux kernel SEV guest certificate handling (get_ext_report) page allocation API usage = alloc_pages_exact()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52959?
The severity of CVE-2026-52959 is rated at 34.
How do I fix CVE-2026-52959?
To fix CVE-2026-52959, upgrade to the patched version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2026-52959?
CVE-2026-52959 affects systems running the Linux kernel with vulnerabilities in the virt and sev-guest functionalities.
What type of vulnerability is CVE-2026-52959?
CVE-2026-52959 is a security vulnerability in the Linux kernel related to the handling of host-controlled page orders.
What are the potential impacts of CVE-2026-52959?
The potential impacts of CVE-2026-52959 may include exploitation by attackers to manipulate memory management within the virtualization environment.