From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4BAB237E5DC for ; Sat, 25 Jul 2026 08:53:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784969605; cv=none; b=GNtjrPe21x8kwAktGOZRV5OltD70aXtW6Sr3ZMH91t7yOP3U7h/d3zbcI6IVO7+1QRLUEeaU2fgP6/AQZPYqvBr72NU0aQF4f2lX3TfMZ9PhtyTW/J/9FMxVJT7HWVyPataZha9HHCN9bGInT9HmQORgWLAQ4LwimmCrLxkMz84= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784969605; c=relaxed/simple; bh=Q7FfCnleaTi3wKXer9lMLoyxnK5KrjZTvjp91SNpfFU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=LHkNmkQW+//ZHA3Lg3WJZuGp+aduKl2y1wBqLJHrW0bES5OjVL5/2KCmkg5zkax5O6P3WXLMwkfaMkdxMDiamwNlAy6KxOWILybRj40IktkZn3GA8HqzZxj18XNDWvsgsmb77vuXgVerqmnFipgEunTZQNKCNbnTFR5DKFHuWHk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Wm8rDD4B; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Wm8rDD4B" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A92751F000E9; Sat, 25 Jul 2026 08:53:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784969604; bh=0A/6uhVFzB9qJsWnrsDAQR/sYh80A9jEi2OA/mYK6hU=; h=From:To:Cc:Subject:Date:Reply-To; b=Wm8rDD4BSz/5dHcPQitvDxLlVtubjAdps+oJCn/JKid4EY2I1MsGQwfzWGe1c2GLh 0XUknYr3oPdV8KcivBt32qBDqJzz+Ul4GIQyFkOZIsS1QIPk64OlmFIwURJ120XTyh YlPX6SShiQwusJrR0UaIE8+Ykq7Ubvrb5CqylXyA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64285: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest Date: Sat, 25 Jul 2026 10:48:22 +0200 Message-ID: <2026072503-CVE-2026-64285-0481@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2506; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=EIrAR8ExCQJOfrT3MsRylaWLWx9ieUOJD5FWXzfvGBQ=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkpFc6XmF8Ws9v4XF/R/l57p9LZ/Pob78LnNdfUJDrWz tI2PtbVEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABO5HsQwT1Nj4ju3SYf/7T73 asvpbRYTtq2vUGFY0Dztg9/H6pNOnrOTO0L7w4IvyF0xAAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guest_memfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the "correct" CPUID information if the userspace provided data is rejected by trusted firmware. Because KVM writes to the source page using a kernel mapping, pinning for read could result in KVM clobbering read-only memory. Note, well-behaved VMMs are unlikely to be affected, as CPUID information is almost always dynamically generated by userspace, i.e. it's unlikely for the CPUID information to be backed by a read-only mapping. [sean: rewrite shortlog and changelog, tag for stable@] The Linux kernel CVE team has assigned CVE-2026-64285 to this issue. Affected and fixed versions =========================== Issue introduced in 7.0 with commit 2a62345b30529e488beb6a1220577b3495933724 and fixed in 7.1.4 with commit dcdb476f5fc5701ec06c23efe3e3529f07ca391e Issue introduced in 7.0 with commit 2a62345b30529e488beb6a1220577b3495933724 and fixed in 7.2-rc1 with commit f13e900599089b10113ceb36013423f0837c6792 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64285 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/x86/kvm/svm/sev.c arch/x86/kvm/vmx/tdx.c include/linux/kvm_host.h virt/kvm/guest_memfd.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/dcdb476f5fc5701ec06c23efe3e3529f07ca391e https://git.kernel.org/stable/c/f13e900599089b10113ceb36013423f0837c6792