CVE-2026-64104: virt: sev-guest: Explicitly leak pages in unknown state
In the Linux kernel, the following vulnerability has been resolved:
virt: sev-guest: Explicitly leak pages in unknown state
When setmemory{encrypted,decrypted}() fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view of the caller.
Since the pages may be left in an unencrypted state, they are not suitable for general use, and cannot be returned safely to the buddy allocator. Avoid the issue by never freeing the pages, and then do the proper accounting by calling snpleakpages().
Affected Software
Remediation
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An attacker needs local access with low privileges. Exploitation involves causing set_memory_encrypted() or set_memory_decrypted() to fail in the SEV guest code path.
Which systems are realistically exposed?
The affected component is the Linux kernel's SEV guest support. Systems that do not use this SEV guest functionality are not indicated by the provided data as exposed to this specific issue.
What is the risk if the memory-operation calls fail?
The caller cannot determine where the operation failed, leaving affected pages in an unknown state. Because pages may remain unencrypted, returning them to the buddy allocator could make them available for general use unsafely.
What should be done if patching cannot happen immediately?
The provided remediation is to apply the available patch. The fix prevents unsafe reuse by explicitly retaining pages in an unknown state and accounting for them through snp_leak_pages().