In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Do not use host-controlled page order in cleanup path When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST), get_ext_report() allocates a buffer to retrieve a certificate blob from the host, keeping track of its size in report_req->certs_len. However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating an invalid buffer size, as well as the expected length of such buffer. get_ext_report() subsequently updates report_req->certs_len with the host-controlled value, and cleans up the buffer by computing a page order from such value. This is incorrect, as the host-provided length may not match the page order of the original allocation, potentially resulting in corruption in the page allocator. Fix this by using alloc_pages_exact() instead, and reusing @npages to compute the size passed to free_pages_exact(). For consistency, also use @npages to compute the size when allocating the pages, even though this last change has no functional effect.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - virt: sev-guest: Do not use host-controlled page order in cleanup path When issuing an extended guest     request (SVM_VMGEXIT_EXT_GUEST_REQUEST), get_ext_report() allocates a buffer to retrieve a certificate     blob from the host, keeping track of its size in report_req->certs_len. However, the host may return     SNP_GUEST_VMM_ERR_INVALID_LEN, indicating an invalid buffer size, as well as the expected length of such     buffer. get_ext_report() subsequently updates report_req->certs_len with the host-controlled value, and     cleans up the buffer by computing a page order from such value. This is incorrect, as the host-provided     length may not match the page order of the original allocation, potentially resulting in corruption in the     page allocator. Fix this by using alloc_pages_exact() instead, and reusing @npages to compute the size     passed to free_pages_exact(). For consistency, also use @npages to compute the size when allocating the     pages, even though this last change has no functional effect. (CVE-2026-52959)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
323355	Linux Distros Unpatched Vulnerability : CVE-2026-52959	Nessus	Misc.	Local	high
322020	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1866)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-52959

high

Tenable Plugins

high

high

high