Answer in brief
CVE-2026-52959 records a High severity (CVSS 7.8) vulnerability in virt: sev-guest: Do not use host-controlled page order in cleanup path. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=3e385c0d6ce88ac9916dcf84267bd5855d830748 <3f6fb0211b39aaa1b841260681dd02ca6b693ed5 || >=3e385c0d6ce88ac9916dcf84267bd5855d830748 <9e48b4f813d2c3db75d522aa82ab705ce04b7e2d || >=3e385c0d6ce88ac9916dcf84267bd5855d830748 <23e6a1ca04ae44806439a5a446e62e4d42e80bb4 || 0b16521f95c875e79d657cb8d6911c15080dbb80 || >=6.13.8 <6.14 | 3f6fb0211b39aaa1b841260681dd02ca6b693ed5, 9e48b4f813d2c3db75d522aa82ab705ce04b7e2d, 23e6a1ca04ae44806439a5a446e62e4d42e80bb4, 6.14 |
| Linux/Linuxgeneric | 6.14 | Not reported |
Published upstream
Jun 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 24, 2026
In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Do not use host-controlled page order in cleanup path When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST), get_ext_report() allocates a buffer to retrieve a certificate blob from the host, keeping track of its size in report_req->certs_len. However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating an invalid buffer size, as well as the expected length of such buffer. get_ext_report() subsequently updates report_req->certs_len with the host-controlled value, and cleans up the buffer by computing a page order from such value. This is incorrect, as the host-provided length may not match the page order of the original allocation, potentially resulting in corruption in the page allocator. Fix this by using alloc_pages_exact() instead, and reusing @npages to compute the size passed to free_pages_exact(). For consistency, also use @npages to compute the size when allocating the pages, even though this last change has no functional effect.
Quoted source text, attributed separately from HOL analysis.