CVE-2026-53360

High [CVE-2026-53360] Require in-GHCB scratch area if GHCB v2+ is in use

CVE-2026-53360Source published Jul 4, 2026Source updated Jul 4, 2026

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB spec, when using GHCB v2+ require the software scratch area to reside in the GHCB's shared buffer. Note, things like Page State Change (PSC) requests _rely_ on this behavior, as the guest can't provide a length when making the request, i.e. the size of the guest payload is bounded by the size of the shared buffer. Failure to force usage of the GHCB, and a slew of other flaws, lets a malicious SNP guest corrupt host kernel heap memory, and leak host heap layout information. setup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2), where exit_info_2 is guest-controlled. With exit_info_2=24, this yields a 24-byte allocation in…

Affected products in this advisory

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Red Hat package: kernel-rt

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• If confidential VMs are not in use, this vulnerability can be mitigated by disabling SEV-SNP support on the host, removing the attack surface entirely. Create a file in `/etc/modprobe.d/` with a descriptive name, such as `cve-2026-53360-mitigation.conf`. In that file, disable SEV-SNP for the `kvm_amd` kernel module: ``` options kvm_amd sev_snp=0 ``` To validate, read the file `/sys/module/kvm_amd/parameters/sev_snp`. This file should read `N` to indicate that the feature is disabled. If SEV-SNP cannot be disabled, run SEV-SNP hosts on isolated environments and restrict the ability to create SNP-enabled VMs to trusted tenants/administrators only.