An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB spec, when using GHCB v2+     require the software scratch area to reside in the GHCB's shared buffer. Note, things like Page State     Change (PSC) requests _rely_ on this behavior, as the guest can't provide a length when making the     request, i.e. the size of the guest payload is bounded by the size of the shared buffer. Failure to force     usage of the GHCB, and a slew of other flaws, lets a malicious SNP guest corrupt host kernel heap memory,     and leak host heap layout information. setup_vmgexit_scratch() allocates a buffer via     kvzalloc(exit_info_2), where exit_info_2 is guest-controlled. With exit_info_2=24, this yields a 24-byte     allocation in kmalloc-cg-32 (32-byte slab objects). The buffer holds an 8-byte psc_hdr followed by 8-byte     psc_entry structs, so only entries[0] and entries[1] are in-bounds. snp_begin_psc() validates end_entry     against VMGEXIT_PSC_MAX_COUNT (253) but NOT against the actual buffer size: idx_end = hdr->end_entry; if     (idx_end >= VMGEXIT_PSC_MAX_COUNT) { // checks 253, not buffer snp_complete_psc(svm, ...); return 1; } for     (idx = idx_start; idx <= idx_end; idx++) { entry_start = entries[idx]; // OOB when idx >= 2 The guest sets     end_entry=10+, causing the host to iterate entries[2+] which are OOB into adjacent slab objects. For each     OOB entry: - The host reads 8 bytes (OOB READ / info leak oracle) - If the data passes PSC validation,
    __snp_complete_one_psc() writes cur_page = 1 or 512 into the entry (OOB WRITE, sev.c:3806) - If validation     fails, the error response reveals whether adjacent memory is zero vs non-zero (information disclosure to     guest) The guest controls allocation size (exit_info_2), entry range (cur_entry/end_entry), and can fire     unlimited VMGEXITs to repeatedly hit different slab positions. By exploiting the variety of bugs, a     malicious SEV-SNP guest can: - OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure) - OOB     write cur_page bits into adjacent objects (heap corruption) - Trigger use-after-free conditions across     VMGEXITs E.g. with KASAN enabled, a single insmod of the PoC guest module produces 73 KASAN reports: BUG:
    KASAN: slab-out-of-bounds in snp_begin_psc+0x126/0x890 Read of size 8 at addr ffff888219ffb5e0 by task     qemu-system-x86/2199 BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468/0x890 Write of size 8 at addr     ffff888351566648 by task qemu-system-x86/2199 The buggy address belongs to the object at ffff888XXXXXXXXX     which belongs to the cache kmalloc-cg-32 of size 32 The buggy address is located N bytes to the right of     allocated 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX) Breakdown: 62 slab-out-of-bounds (reads +     writes past allocation) 7 slab-use-after-free 4 use-after-free All credit to Stan for the wonderful     description and reproducer! [sean: write changelog] (CVE-2026-53360)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
329149	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3166-1)	Nessus	SuSE Local Security Checks	7/23/2026	7/23/2026	medium
322087	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)	Nessus	Amazon Linux Local Security Checks	6/22/2026	7/31/2026	medium
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	6/26/2026	8/1/2026	high
325341	Linux Distros Unpatched Vulnerability : CVE-2026-53360	Nessus	Misc.	7/7/2026	7/31/2026	high

Detections

Analytics

Plugins Search

medium

medium

high

high