CVE-2026-64285 (GCVE-0-2026-64285)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-07-25 08:49
VLAI
Title
KVM: SEV: Pin source page for write when adding CPUID data for SNP guest
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guest_memfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the "correct" CPUID information if the userspace provided data is rejected by trusted firmware. Because KVM writes to the source page using a kernel mapping, pinning for read could result in KVM clobbering read-only memory. Note, well-behaved VMMs are unlikely to be affected, as CPUID information is almost always dynamically generated by userspace, i.e. it's unlikely for the CPUID information to be backed by a read-only mapping. [sean: rewrite shortlog and changelog, tag for stable@]
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2a62345b30529e488beb6a1220577b3495933724 , < dcdb476f5fc5701ec06c23efe3e3529f07ca391e (git)
Affected: 2a62345b30529e488beb6a1220577b3495933724 , < f13e900599089b10113ceb36013423f0837c6792 (git)
Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c",
            "arch/x86/kvm/vmx/tdx.c",
            "include/linux/kvm_host.h",
            "virt/kvm/guest_memfd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dcdb476f5fc5701ec06c23efe3e3529f07ca391e",
              "status": "affected",
              "version": "2a62345b30529e488beb6a1220577b3495933724",
              "versionType": "git"
            },
            {
              "lessThan": "f13e900599089b10113ceb36013423f0837c6792",
              "status": "affected",
              "version": "2a62345b30529e488beb6a1220577b3495933724",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c",
            "arch/x86/kvm/vmx/tdx.c",
            "include/linux/kvm_host.h",
            "virt/kvm/guest_memfd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Pin source page for write when adding CPUID data for SNP guest\n\nWhen populating a guest_memfd instance with the initial CPUID data for an\nSNP guest, acquire a writable pin on the source page as KVM will write back\nthe \"correct\" CPUID information if the userspace provided data is rejected\nby trusted firmware.  Because KVM writes to the source page using a kernel\nmapping, pinning for read could result in KVM clobbering read-only memory.\n\nNote, well-behaved VMMs are unlikely to be affected, as CPUID information\nis almost always dynamically generated by userspace, i.e. it\u0027s unlikely for\nthe CPUID information to be backed by a read-only mapping.\n\n[sean: rewrite shortlog and changelog, tag for stable@]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-25T08:49:26.898Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dcdb476f5fc5701ec06c23efe3e3529f07ca391e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f13e900599089b10113ceb36013423f0837c6792"
        }
      ],
      "title": "KVM: SEV: Pin source page for write when adding CPUID data for SNP guest",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64285",
    "datePublished": "2026-07-25T08:49:26.898Z",
    "dateReserved": "2026-07-19T15:36:31.777Z",
    "dateUpdated": "2026-07-25T08:49:26.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64285",
      "date": "2026-08-03",
      "epss": "0.00189",
      "percentile": "0.08842"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64285\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:09.140\",\"lastModified\":\"2026-07-30T15:00:27.343\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: SEV: Pin source page for write when adding CPUID data for SNP guest\\n\\nWhen populating a guest_memfd instance with the initial CPUID data for an\\nSNP guest, acquire a writable pin on the source page as KVM will write back\\nthe \\\"correct\\\" CPUID information if the userspace provided data is rejected\\nby trusted firmware.  Because KVM writes to the source page using a kernel\\nmapping, pinning for read could result in KVM clobbering read-only memory.\\n\\nNote, well-behaved VMMs are unlikely to be affected, as CPUID information\\nis almost always dynamically generated by userspace, i.e. it\u0027s unlikely for\\nthe CPUID information to be backed by a read-only mapping.\\n\\n[sean: rewrite shortlog and changelog, tag for stable@]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/svm/sev.c\",\"arch/x86/kvm/vmx/tdx.c\",\"include/linux/kvm_host.h\",\"virt/kvm/guest_memfd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2a62345b30529e488beb6a1220577b3495933724\",\"lessThan\":\"dcdb476f5fc5701ec06c23efe3e3529f07ca391e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2a62345b30529e488beb6a1220577b3495933724\",\"lessThan\":\"f13e900599089b10113ceb36013423f0837c6792\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/svm/sev.c\",\"arch/x86/kvm/vmx/tdx.c\",\"include/linux/kvm_host.h\",\"virt/kvm/guest_memfd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/dcdb476f5fc5701ec06c23efe3e3529f07ca391e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f13e900599089b10113ceb36013423f0837c6792\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-27T08:17:04+00:00",
      "cve": "CVE-2026-64285",
      "id": "CVE-2026-64285",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "275",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64285.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-07-25T16:46:35Z",
      "cve": "CVE-2026-64285",
      "id": "CVE-2026-64285",
      "initial_release_date": "2026-07-25T16:46:35Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64285",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64285.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.