CVE-2026-53345: Linux KVM Memory Leak in SEV-ES VM Destruction

Technical summary

The vulnerability stems from a false-positive WARN condition in KVM's dirty page tracking mechanism. When marking guest memory as dirty, KVM validates that a running vCPU context exists to ensure the dirty page notification is properly pushed to the active vCPU's dirty ring. However, during VM destruction for SEV-ES guests, KVM may need to unmap guest pages that were held writable across a userspace exit—a scenario where no vCPU is actively loaded. The original code triggers a WARN in this condition, even though it's harmless: if the VM refcount has reached zero, no userspace process holds a valid mapping to the dirty ring, making the missed dirty notification irrelevant. The fix conditions the WARN to fire only when the VM is still alive (refcount > 0), eliminating the false positive during legitimate cleanup.

Business impact

This vulnerability primarily affects infrastructure operators running SEV-ES virtual machines on Linux KVM hosts. The memory leak accumulates across affected VM lifecycle events, potentially degrading host performance if many VMs are created and destroyed. However, the impact is limited to the VM destruction path and does not compromise guest data security or allow host escape. For organizations heavily invested in encrypted VM deployments (e.g., confidential computing workloads), the resource waste may influence scheduling efficiency and increase operational costs over time, but the business criticality is low unless memory exhaustion becomes a concern in resource-constrained environments.

Affected systems

Linux kernel versions with KVM support are affected, specifically those running SEV-ES virtual machines. SEV-ES is an AMD security feature used primarily on EPYC processors; systems using other processor architectures or those not running encrypted VMs may not trigger this code path. The vulnerability manifests only during the vCPU destruction phase after a userspace-initiated VM exit without a subsequent KVM_RUN call, meaning it is reproducible in specific VM lifecycle scenarios rather than affecting all KVM deployments.

Exploitability

This vulnerability cannot be exploited remotely and poses no security boundary violation. It requires local access to the hypervisor host and can only be triggered by a user with permissions to manage and destroy VMs. The impact is limited to a resource leak (improper memory accounting), not unauthorized data access or system compromise. Exploitability in a security context is effectively zero; this is a reliability and resource management issue rather than a security breach vector.

Remediation

Apply a Linux kernel patch that conditions the WARN check to only fire when the VM refcount is non-zero. This prevents false positives during legitimate VM destruction while preserving the original safety check for active VMs. Organizations should update to a patched kernel version once available from their distribution or verify the fix against upstream kernel releases. No configuration changes or workarounds are necessary; patching the kernel is the sole remediation path.

Patch guidance

Monitor your Linux distribution's kernel advisories for an update addressing CVE-2026-53345. The fix is a targeted logic change to KVM's dirty page tracking code and is low-risk for backporting to stable kernel branches. Verify the patch in your distribution's advisory or upstream kernel commit history before deployment. Test the update in a non-production environment first, particularly if your infrastructure runs SEV-ES workloads, to confirm memory leak behavior is resolved. No special migration steps are required; standard kernel update procedures apply.

Detection guidance

Monitor kernel logs for WARN_ON messages originating from KVM's dirty page marking function during VM destruction events. Elevated kernel memory usage correlated with VM creation/destruction cycles may indicate the leak is occurring. For affected environments, tracking memory accounting before and after VM lifecycle operations can reveal resource accumulation. However, detection is primarily post-hoc; prevention through patching is the recommended approach. Consider enabling memory instrumentation tools (e.g., kmemleak) on non-production systems to validate the leak's absence post-patch.

Why prioritize this

While the CVSS score is moderate (5.5), the vulnerability's actual risk to operations is low because it does not expose security boundaries or enable privilege escalation. Prioritize patching based on infrastructure maturity: organizations with dense SEV-ES VM deployments and tight memory constraints should patch sooner to avoid cumulative resource waste. Environments without encrypted VMs or with abundant hypervisor memory can defer patching to standard maintenance windows. This is not a candidate for emergency patching but should be included in routine kernel security updates.

Risk score, explained

The CVSS:3.1 score of 5.5 (MEDIUM) reflects a local attack vector, low complexity, low privilege requirements, and high availability impact (DoS potential through memory exhaustion). However, the actual exploitability is constrained by the specific SEV-ES lifecycle requirement and the gradual nature of the leak, reducing real-world severity below the numeric score. The score appropriately penalizes the availability impact but does not reflect the limited attack surface or the fact that this is a resource leak, not an active security vulnerability.

Frequently asked questions