The Linux kernel vulnerability CVE-2026-63794 involves a page overflow in the sev_dbg_crypt() function within the KVM SVM module's ENCRYPT path. The flaw occurs because the transfer length per iteration is bounded by the source page offset but not by the destination page offset. When the destination offset (d_off) is greater than the source offset (s_off), the encryption path performs a read-modify-write using a single-page intermediate buffer (dst_tpage) that is only 4096 bytes in size. The PSP command writes more bytes than the buffer can hold, causing a buffer overflow of up to 15 bytes. This leads to memory corruption and a use-after-free condition detected by KASAN. The fix bounds the length by the destination page offset to prevent overflow, aligning with existing checks in sev_send_update_data(). The vulnerability is classified under CWE-787 (Out-of-bounds Write). No explicit affected versions are provided. The vulnerability has a high severity rating due to its potential impact on confidentiality, integrity, and availability.

The vulnerability allows a buffer overflow of up to 15 bytes in a kernel memory buffer during encryption operations in the KVM SVM module. This can lead to memory corruption and use-after-free conditions, potentially compromising system stability and security. The CVSS vector indicates local attack vector with low attack complexity and low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. This means an attacker with local access and limited privileges could exploit this flaw to cause significant damage to the system's security and stability.

A fix for this vulnerability has been implemented in the Linux kernel by bounding the transfer length by the destination page offset to prevent buffer overflow. Since no explicit patch links or affected versions are provided, users should apply the latest Linux kernel updates that include this fix. Monitor the official Linux kernel advisories and update to a fixed kernel version once available. Patch status is not yet confirmed from the vendor advisory; check the Linux kernel security advisories for current remediation guidance.