Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When… (CVE-2026-64285)
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guest_memfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the "correct" CPUID information if the userspace provided data is rejected by trusted firmware. Because KVM writes to the source page using a kernel mapping, pinning for read could result in KVM clobbering read-only memory. Note, well-behaved VMMs are unlikely to be affected, as CPUID information is almost always dynamically generated by userspace, i.e. it's unlikely for the CPUID information to be backed by a read-only mapping. [sean: rewrite shortlog and changelog, tag for stable@]
AI Analysis
Technical Summary
This vulnerability (CVE-2026-64285) in the Linux kernel's KVM SEV feature occurred when populating a guest_memfd instance with initial CPUID data for an SNP guest. The kernel failed to acquire a writable pin on the source page, instead only pinning it for read. Since KVM writes back the corrected CPUID data if the userspace data is rejected by trusted firmware, pinning for read could cause KVM to overwrite read-only memory. The fix ensures that the source page is pinned for write access to prevent memory corruption. This issue is unlikely to affect well-behaved VMMs that dynamically generate CPUID data.
Potential Impact
If exploited, this vulnerability could cause KVM to write to read-only memory, potentially leading to memory corruption within the kernel. However, the impact is limited because typical VMMs dynamically generate CPUID data, avoiding the problematic scenario. No known exploits are reported in the wild.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to pin the source page for write access when adding CPUID data for SNP guests. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level fix, upgrading the kernel is the recommended remediation. No additional mitigations are indicated.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When… (CVE-2026-64285)
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guest_memfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the "correct" CPUID information if the userspace provided data is rejected by trusted firmware. Because KVM writes to the source page using a kernel mapping, pinning for read could result in KVM clobbering read-only memory. Note, well-behaved VMMs are unlikely to be affected, as CPUID information is almost always dynamically generated by userspace, i.e. it's unlikely for the CPUID information to be backed by a read-only mapping. [sean: rewrite shortlog and changelog, tag for stable@]
CVSS v3.1
Score 5.5medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-64285) in the Linux kernel's KVM SEV feature occurred when populating a guest_memfd instance with initial CPUID data for an SNP guest. The kernel failed to acquire a writable pin on the source page, instead only pinning it for read. Since KVM writes back the corrected CPUID data if the userspace data is rejected by trusted firmware, pinning for read could cause KVM to overwrite read-only memory. The fix ensures that the source page is pinned for write access to prevent memory corruption. This issue is unlikely to affect well-behaved VMMs that dynamically generate CPUID data.
Potential Impact
If exploited, this vulnerability could cause KVM to write to read-only memory, potentially leading to memory corruption within the kernel. However, the impact is limited because typical VMMs dynamically generate CPUID data, avoiding the problematic scenario. No known exploits are reported in the wild.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to pin the source page for write access when adding CPUID data for SNP guests. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level fix, upgrading the kernel is the recommended remediation. No additional mitigations are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9frv-wmxv-xpwj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64285"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420e9c2644c7f80865db
Added to database: 07/25/2026, 23:09:02 UTC
Last enriched: 08/15/2026, 03:14:55 UTC
Last updated: 09/08/2026, 22:52:14 UTC
Views: 37
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.