CVE-2026-64104 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
virt: sev-guest: Explicitly leak pages in unknown state
When set_memory_{encrypted,decrypted}() fail, the user cannot know at which
point the function failed, meaning that the pages are left in an unknown state from the point of view of the caller.
Since the pages may be left in an unencrypted state, they are not suitable for general use, and cannot be returned safely to the buddy allocator. Avoid the issue by never freeing the pages, and then do the proper accounting by calling snp_leak_pages().
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability described represents a critical memory management flaw in the Linux kernel's virtualization subsystem, specifically affecting SEV (Secure Encrypted Virtualization) guest implementations. This issue resides within the hypervisor's handling of memory encryption states and demonstrates a fundamental failure in error recovery mechanisms that can lead to severe security implications. The problem manifests when the set_memory_encrypted() and set_memory_decrypted() functions encounter failures during memory state transitions, leaving system pages in an ambiguous encryption state that cannot be reliably determined by calling code.
The technical root cause stems from inadequate error handling and state management within the SEV guest memory subsystem. When these core memory management functions fail, they do not provide sufficient information to callers about exactly where the failure occurred, resulting in pages being left in an indeterminate state between encrypted and unencrypted conditions. This ambiguous state creates a dangerous scenario where memory pages may appear to be in one encryption state while actually existing in another, potentially exposing sensitive data or creating inconsistencies in the virtualized environment. The vulnerability directly maps to CWE-391 which addresses unhandled errors in memory management operations, and represents a classic example of improper error recovery leading to resource state corruption.
The operational impact of this vulnerability extends beyond simple memory management issues to encompass fundamental security assurances within SEV-enabled virtual environments. Pages left in an unknown encryption state cannot be safely returned to the kernel's buddy allocator system, as their actual memory state remains undetermined. This creates a potential attack surface where adversaries might exploit the inconsistent memory states to gain unauthorized access to sensitive information or manipulate the virtualization environment. The vulnerability particularly affects systems running SEV guests where memory encryption is actively managed, potentially compromising the integrity of encrypted virtual machine memory and undermining the security guarantees that SEV is designed to provide.
The mitigation strategy implemented involves a deliberate design choice to never free pages in an unknown state, instead employing explicit accounting through the snp_leak_pages() function. This approach prevents the system from attempting to return potentially corrupted memory pages to the allocator while maintaining proper resource accounting for tracking leaked pages. The solution aligns with ATT&CK technique T1550.003 which deals with using stolen or compromised credentials, as it prevents the exploitation of memory state inconsistencies that could be leveraged for privilege escalation. This defensive programming approach ensures that even in failure scenarios, the system maintains predictable and secure memory states, though it does introduce a minor resource leak where pages are accounted for but not freed, representing an acceptable trade-off between security and resource utilization.