Answer in brief
CVE-2026-63937 records a Unknown severity vulnerability in KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9b54e248d2644be71cb394eb85f31ad99e023a05 <bd232801ef1d1fd985d2d4ca3cd1d888303ca86f || >=9b54e248d2644be71cb394eb85f31ad99e023a05 <b1dfaa6f7a957726a6800135be3659fbe4bbf2a4 || >=9b54e248d2644be71cb394eb85f31ad99e023a05 <edbbe88f83b524434974e84808d3093199d67c24 || >=9b54e248d2644be71cb394eb85f31ad99e023a05 <c8cc238093ca6c99267032f6cfe78f59389f3157 | bd232801ef1d1fd985d2d4ca3cd1d888303ca86f, b1dfaa6f7a957726a6800135be3659fbe4bbf2a4, edbbe88f83b524434974e84808d3093199d67c24, c8cc238093ca6c99267032f6cfe78f59389f3157 |
| Linux/Linuxgeneric | 6.11 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Use READ_ONCE() when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READ_ONCE()/WRITE_ONCE() for cases where KVM is writing (and not consuming the result!), as the guest isn't supposed to touch the buffer while it's being processed. I.e. using READ_ONCE() is all about protecting against misbehaving guests.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-63937 records a Unknown severity vulnerability in KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9b54e248d2644be71cb394eb85f31ad99e023a05 <bd232801ef1d1fd985d2d4ca3cd1d888303ca86f || >=9b54e248d2644be71cb394eb85f31ad99e023a05 <b1dfaa6f7a957726a6800135be3659fbe4bbf2a4 || >=9b54e248d2644be71cb394eb85f31ad99e023a05 <edbbe88f83b524434974e84808d3093199d67c24 || >=9b54e248d2644be71cb394eb85f31ad99e023a05 <c8cc238093ca6c99267032f6cfe78f59389f3157 | bd232801ef1d1fd985d2d4ca3cd1d888303ca86f, b1dfaa6f7a957726a6800135be3659fbe4bbf2a4, edbbe88f83b524434974e84808d3093199d67c24, c8cc238093ca6c99267032f6cfe78f59389f3157 |
| Linux/Linuxgeneric | 6.11 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Use READ_ONCE() when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READ_ONCE()/WRITE_ONCE() for cases where KVM is writing (and not consuming the result!), as the guest isn't supposed to touch the buffer while it's being processed. I.e. using READ_ONCE() is all about protecting against misbehaving guests.
Quoted source text, attributed separately from HOL analysis.