CVE-2026-52959: Linux Kernel SEV-SNP Memory Corruption via Host-Controlled Buffer Size

Technical summary

CVE-2026-52959 affects the get_ext_report() function in the SEV-SNP guest code (virt/sev-guest). During extended guest request processing (SVM_VMGEXIT_EXT_GUEST_REQUEST), the function allocates memory via alloc_pages() to hold a certificate blob. When the host returns SNP_GUEST_VMM_ERR_INVALID_LEN, it provides both an error code and the required buffer size in report_req->certs_len. The vulnerable code accepts this host-controlled length value and subsequently computes a page order from it to deallocate memory using free_pages(). Since the page order derived from an arbitrary host-provided length may not correspond to the original allocation order, this causes incorrect deallocation and page allocator corruption. The fix replaces alloc_pages() and free_pages() with alloc_pages_exact() and free_pages_exact(), which manage arbitrary byte counts rather than page orders, eliminating the mismatch between allocation and deallocation.

Business impact

This vulnerability poses a HIGH severity risk to organizations running AMD SEV-SNP encrypted VMs with multi-tenant or untrusted hypervisor scenarios. An attacker controlling the hypervisor can corrupt guest kernel memory, potentially escalating privileges, reading sensitive data from other guests, or destabilizing the system. For cloud providers and enterprises using confidential computing, this undermines the security guarantees that SEV-SNP is meant to provide. Patching is critical for environments where guests are protected against hypervisor attacks.

Affected systems

The Linux kernel is affected across multiple versions. This vulnerability is specific to systems with AMD SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) capability enabled. Affected systems include guest kernels running on SEV-SNP-capable AMD EPYC processors (Naples, Rome, Milan, Genoa generations and later). Non-SEV-SNP systems and guests running on other CPU architectures or hypervisors without SEV-SNP support are not affected. The vulnerability requires the guest kernel to be running and for the extended guest request mechanism to be invoked, typically through attestation or certificate retrieval workflows.

Exploitability

Exploitation requires LOCAL access to the guest system with elevated privileges (the CVSS vector PR:L indicates a privileged attacker). The attacker must be able to trigger get_ext_report() execution, typically through the sev-guest device interface or attestation workflows. A more direct attack vector exists if the attacker controls the hypervisor itself, in which case they can craft malicious responses to VMGEXIT calls. The vulnerability is not remotely exploitable and does not require user interaction. Successful exploitation leads to kernel memory corruption with HIGH impact on confidentiality, integrity, and availability.

Remediation

Apply the kernel patch that replaces the vulnerable alloc_pages()/free_pages() pattern with alloc_pages_exact()/free_pages_exact(). This ensures memory deallocation uses the original allocation size tracked in @npages rather than a size derived from host-controlled data. Verify that your kernel version includes the fix by checking git commit history or vendor release notes. For immediate containment, restrict unprivileged access to the sev-guest device and limit guest-to-hypervisor attestation operations to trusted scenarios.

Patch guidance

Upgrade the Linux kernel to a version that includes the fix for CVE-2026-52959. The patch introduces alloc_pages_exact() and free_pages_exact() calls, along with consistent use of the @npages variable for size calculations. Verify the exact fixed kernel version against your Linux distribution's security advisories (Ubuntu, Red Hat, SUSE, Debian, etc.), as patch availability and version numbers vary by vendor. Test the patched kernel in your SEV-SNP environment before production deployment to confirm compatibility with your attestation workflows.

Detection guidance

Monitor for kernel memory corruption symptoms: page allocator errors, BUG_ON() triggers in mm/page_alloc.c, or unexpected kernel panics with traces involving sev-guest or get_ext_report(). Kernel logs and dmesg output may show warnings like 'bad page state' or 'memory corruption detected.' Use audit logs to track sev-guest device access (/dev/sev-guest or /dev/sev-guest-[instance]) and extended guest request (ioctl) invocations. For forensics, capture kernel panic dumps and memory corruption BUG traces. Note that exploitation may be difficult to distinguish from unrelated kernel bugs, so prioritize patching over detection.

Why prioritize this

This is a HIGH-severity local privilege escalation vulnerability affecting the SEV-SNP confidential computing feature. It is not yet in CISA's KEV catalog, but it undermines the memory safety guarantees of the Linux kernel in a sensitive security-critical context. Organizations using SEV-SNP for confidential workloads, particularly in multi-tenant cloud environments, should prioritize patching immediately. The vulnerability requires privileged local access and is not widely exploited in the wild, but the impact potential is severe enough to warrant urgent action for affected deployments.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector Local (AV:L) — requires local system access; Attack Complexity Low (AC:L) — no special conditions needed; Privileges Required Low (PR:L) — an elevated but not root-level privilege is sufficient; User Interaction None (UI:N) — attack is automatic; Scope Unchanged (S:U) — impact limited to the guest; Confidentiality High (C:H), Integrity High (I:H), Availability High (A:H) — full compromise of kernel memory. The score appropriately penalizes the local-only nature but reflects the severe impact of successful exploitation on system security and data protection in SEV-SNP environments.

Frequently asked questions