Medium [CVE-2026-63937] Use READ_ONCE when reading entries/indices from PSC buffer

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Use READ_ONCE() when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs.

Don't bother with READ_ONCE()/WRITE_ONCE() for cases where KVM is writing (and not consuming the result!), as the guest isn't supposed to touch the buffer while it's being processed. I.e. using READ_ONCE() is all about protecting against misbehaving guests.

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) with Secure Encrypted Virtualization (SEV). A misbehaving guest could exploit this timing issue by modifying the buffer after it has been checked but before it is used, potentially leading to an impact on the integrity of the virtualized environment.

A TOCTOU race exists in the KVM/SEV SNP Page State Change handling path because KVM reads guest accessible PSC header indices and PSC entries without READ_ONCE(). A malicious guest can modify the PSC buffer while the host is validating and consuming it, which can make KVM process inconsistent entry data or index values during page state change handling.

For the CVSS the PR:L is used because the attacker needs the ability to execute code in a guest or otherwise control a guest PSC buffer, but does not need host administrative privileges.