The vulnerability CVE-2026-63938 in the Linux kernel's KVM SEV module concerns improper validation of PSC request indices against the effective size of the scratch area buffer. Specifically, when processing PSC requests, the kernel did not properly check that indices were within the actual buffer size, which may be less than the maximum size if the guest provided a pointer offset within the GHCB shared buffer. This flaw was addressed by adding validation to ensure PSC requests are bounded by the effective buffer size.

The impact details are not explicitly provided in the source data. The vulnerability relates to buffer boundary validation in KVM SEV PSC request processing, which could potentially lead to memory corruption or other unintended behavior if exploited. However, no known exploits in the wild have been reported, and no CVSS score or detailed impact assessment is available.

A fix has been implemented in the Linux kernel to validate PSC request indices against the actual buffer size. Since no specific patch links or vendor advisories are provided, users should apply the latest Linux kernel updates that include this fix. Patch status is not yet confirmed in the provided data — check the official Linux kernel advisories or distribution updates for current remediation guidance.