CVE-2026-64285 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Pin source page for write when adding CPUID data for SNP guest
When populating a guest_memfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the "correct" CPUID information if the userspace provided data is rejected by trusted firmware. Because KVM writes to the source page using a kernel mapping, pinning for read could result in KVM clobbering read-only memory.
Note, well-behaved VMMs are unlikely to be affected, as CPUID information is almost always dynamically generated by userspace, i.e. it's unlikely for the CPUID information to be backed by a read-only mapping.
[sean: rewrite shortlog and changelog, tag for stable@]
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability exists within the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem specifically affecting Secure Nested Paging (SNP) guests utilizing AMD's SEV (Secure Encrypted Virtualization) technology. The flaw occurs during the initialization phase when KVM populates a guest_memfd instance with initial CPUID data for SNP-enabled virtual machines. The vulnerability stems from an improper memory access pattern where the kernel attempts to write back corrected CPUID information to source pages that may have been pinned for read-only access.
The technical implementation issue manifests when KVM adds CPUID data for SNP guests, requiring the kernel to acquire a writable pin on source pages rather than the previously used read-only pinning mechanism. This occurs because KVM must write back corrected CPUID information when userspace-provided data is rejected by the trusted firmware component. The kernel mapping approach used by KVM for writing operations requires writable memory access, and using read-only pinning would result in memory clobbering or system crashes when KVM attempts to modify what it believes to be read-only memory regions.
The operational impact of this vulnerability affects virtualization environments running SNP-enabled guests on AMD processors, particularly those utilizing SEV technology. While well-behaved Virtual Machine Managers are unlikely to be directly affected due to the typical dynamic generation of CPUID information by userspace components, the vulnerability represents a potential security boundary violation that could allow for memory corruption or privilege escalation under specific conditions. The flaw essentially creates a scenario where kernel-level code might attempt to write to read-only memory mappings, potentially leading to system instability or exploitation opportunities.
This vulnerability aligns with CWE-787 (Out-of-bounds Write) and CWE-121 (Stack-based Buffer Overflow) categories as it involves improper memory access patterns that could lead to memory corruption. The issue also relates to ATT&CK technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell) through potential privilege escalation pathways, though the direct attack surface is more limited to virtualization environments. The fix implemented addresses the core memory management issue by ensuring proper writable pinning of source pages during CPUID data initialization for SNP guests, preventing the kernel from attempting writes to read-only mappings.
Mitigation strategies include updating to kernel versions containing the patched implementation that properly handles writable pinning for source pages. System administrators should prioritize patching affected systems running KVM with SNP support, particularly in environments where virtualization security is paramount. Monitoring for memory access violations or system instability during CPUID data initialization processes can help identify potential exploitation attempts. Organizations utilizing AMD SEV-SNP technology should ensure their kernel versions include this fix to maintain proper memory isolation boundaries between guest and host environments.
The vulnerability highlights the complexity of secure virtualization implementations where kernel-level memory management must account for multiple access patterns and security constraints. Proper resource pinning and memory mapping considerations become critical when dealing with trusted firmware interactions and virtual machine state management. This particular flaw demonstrates how seemingly minor memory access decisions in hypervisor code can have significant security implications, particularly in environments where memory integrity is essential for maintaining guest isolation and preventing information leakage between virtual machines.
This fix represents a targeted correction to the memory management approach used during SNP guest initialization, ensuring that KVM properly accounts for write operations when handling CPUID data from userspace. The change maintains backward compatibility while strengthening security boundaries through proper memory access controls. The resolution addresses a specific edge case in virtualization security where kernel code must interact with potentially read-only memory mappings while performing write operations required for firmware validation and data correction processes.