TECH Signal 395
KVM SEV-SNP page state change handler heap overflow fixed in mainline and backported stable kernels
↗
Illustration only Photo by Heather Newsom on Unsplash
A heap out-of-bounds read/write in KVM's SEV-SNP Page State Change handler let a malicious guest corrupt host kernel heap memory; a second researcher independently found the bug after an earlier report, and the fix is now in mainline and several stable branches.
This is a guest-to-host escape primitive: a malicious VM on an affected host can repeatedly corrupt kernel heap and leak its layout across the VM boundary. Operators running kernels with SEV-SNP PSC support from roughly v6.10 onward should apply the patched stable releases, v7.0.12, v6.18.35, or v6.12.93.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
CVE-2026-53360 is a heap out-of-bounds read/write in KVM's SEV-SNP Page State Change handler where the host validates an entry count against a protocol constant of 253 but not against the actual allocated buffer size.
A malicious guest can provide a small buffer while claiming many entries, causing the host to walk past the allocation into kernel heap, enabling corruption and layout leaks as many times as the guest wants.
The fix landed in mainline commit db3f2195d293 and was backported to v7.0.12, v6.18.35, and v6.12.93; every kernel with SNP PSC support since approximately v6.10 was affected.
THE CLUSTER