A critical buffer overflow vulnerability in the Linux kernel KVM SEV component could allow a local attacker to achieve system compromise or denial of service.

The vulnerability resides in the KVM SEV (Secure Encrypted Virtualization) subsystem, where the length of the GHCB (Guest-Hypervisor Communication Block) scratch area is incorrectly calculated. This flaw, which requires no authentication or user interaction to trigger, can lead to buffer overflows during PSC (Page State Change) requests.

Successful exploitation of this vulnerability can lead to memory corruption, potentially resulting in arbitrary code execution or a system crash. Given the CVSS score of 9.3, this flaw is categorized as critical, as it allows an attacker to bypass security boundaries between a guest virtual machine and the hypervisor, leading to a complete compromise of the host system.

Immediate Action: Update the Linux kernel to version 6.12.93, 6.18.35, 7.0.12, or newer, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics, unexpected reboots, or abnormal KVM-related errors that may indicate exploitation attempts.

Compensating Controls: Restrict access to the virtualization host and ensure that untrusted users cannot interact directly with the KVM interface or guest memory management functions.

Public Exploit Available: No

This vulnerability represents a significant risk to virtualized environments running Linux kernels. Administrators should prioritize patching the kernel across all affected hypervisor hosts immediately to prevent potential privilege escalation or host-level compromise. If an immediate reboot is not feasible, ensure that rigorous access controls are in place to limit local access to the system.