The Linux kernel vulnerability CVE-2026-63937 concerns the KVM SEV (Secure Encrypted Virtualization) subsystem. It involved the lack of atomic memory access when reading entries and indices from the guest-accessible Page State Change buffer, potentially allowing TOCTOU bugs. The fix applies the READ_ONCE() macro to these reads, ensuring atomicity and preventing race conditions from guest interference. The vulnerability does not affect cases where KVM writes to the buffer, as the guest is not expected to access it during processing.

The vulnerability could allow a misbehaving guest virtual machine to exploit race conditions in the KVM SEV Page State Change buffer handling, potentially leading to inconsistent or unexpected behavior in the hypervisor's memory management. There is no indication of known exploits in the wild. The impact is limited to scenarios involving guest interference with the PSC buffer, which could affect the integrity of state changes in SEV-enabled virtual machines.

A fix has been implemented in the Linux kernel to use READ_ONCE() when reading from the PSC buffer, addressing the TOCTOU issue. Since the vulnerability is resolved, users should update to the patched Linux kernel version containing this fix. Patch status is not explicitly stated in the provided data; therefore, users should consult the official Linux kernel advisories or distribution updates for the exact patched versions and apply them accordingly.