On July 19, 2026, kernel.org disclosed CVE-2026-63940, a critical flaw in the Linux kernel’s KVM handling for AMD Secure Encrypted Virtualization. The vulnerability—a failure to reject Port I/O requests with a zero length or count—earned a 9.3 CVSS score and can be exploited by a malicious guest to underflow memory calculations in the host kernel. Fixes are now available in Linux 6.12.95, 6.18.35, 7.0.12, and 7.1.

The Zero-Length Bug

At the core of the issue is a small but dangerous oversight in arch/x86/kvm/svm/sev.c, the kernel code responsible for much of KVM’s AMD SEV support. When a guest running under SEV, SEV-ES, or SEV-SNP sends a Port I/O request via the Guest-Hypervisor Communication Block (GHCB), KVM must set up a temporary “software scratch area” to handle the data. The code wasn’t checking whether the requested transfer length or element count was zero before computing buffer sizes. According to the kernel.org advisory, an attacker could craft a request that triggers an integer underflow during those calculations, corrupting the scratch area setup and potentially leading to host compromise.

“Explicitly ignore Port I/O requests of length ‘0’ (or count ‘0’),” the patch states, “so that setting up the software scratch area (and other code) doesn’t have to worry about underflowing the length.” The fix also enables a kernel warning when a zero-length scratch area is attempted, helping catch erroneous internal calls.

The CVSS vector is AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H—local attack, low complexity, no privileges required, no user interaction, with a scope change (meaning the vulnerable component can affect the wider system) and high impact to confidentiality, integrity, and availability. That “local” label does not mean an attacker needs physical access to the host; in a KVM context, it can include code running inside a malicious guest VM.

Who’s Really Affected

Not every Linux system, nor every Windows box, is in the blast radius.

  • Windows workstations and servers running Hyper-V are not affected—the vulnerability lives in Linux KVM code, not Microsoft’s hypervisor. Windows Subsystem for Linux (WSL) does not turn a Windows machine into a KVM host that uses the affected code path.
  • AMD KVM hosts that have the kvm_amd module loaded and SEV enabled are the direct targets. If your host uses Intel processors, or runs KVM without enabling SEV, you are not exposed to this specific CVE.
  • Windows guests running on an affected Linux KVM host are at risk indirectly—if the host is compromised, all its VMs, Windows or otherwise, are in danger. But patching the Windows guest alone does nothing. The fix must go on the Linux host kernel.
  • Cloud and enterprise environments that deploy confidential VMs (SEV-ES, SEV-SNP) should prioritize this patch. These workloads are often chosen precisely because of their security sensitivity, making the hypervisor boundary a critical choke point.

The affected code was introduced in Linux 5.11. That means any kernel from that version up to, but not including, the four fixed releases is potentially vulnerable. Distribution vendors (Red Hat, Ubuntu, SUSE, etc.) often backport fixes into older kernels, so a system’s reported version may not tell the whole story. What matters is whether your installed kernel package contains the commit that resolves CVE-2026-63940.

A Patch Is Only Half the Battle

Installing an updated kernel package does not remediate the vulnerability until the host reboots into that new kernel. This is a classic pitfall in hypervisor operations. A running kernel is the security boundary, and too many incident reports close with “patches applied” while the old vulnerable kernel still hums along.

For hosts that can’t reboot immediately, live migration of VMs to other patched hosts is the standard workaround, but it requires planning: cluster capacity, storage consistency, and post-migration health checks. In capacity-constrained environments, a rolling reboot schedule may be the only option. The key is to never assume ".rpm installed" or ".deb unpacked" equals fixed.

How We Got Here

AMD SEV, first introduced in 2016, encrypts guest memory to protect against a curious or compromised hypervisor. SEV-ES (2017) added encrypted CPU register state, and SEV-SNP (2020) brought integrity protections. These technologies shift trust away from the host, but they don’t eliminate communication between guest and hypervisor. The GHCB protocol defines a structured way for SEV-ES and SNP guests to request services like I/O, page state changes, and more.

Port I/O is an old x86 mechanism still used in virtual platforms for firmware, emulated devices, and legacy compatibility. KVM’s handling of GHCB-based I/O was built with the assumption that request lengths would be sensible. The zero-length edge case wasn’t explicitly rejected, and the arithmetic that followed—calculating buffer end positions with expressions like start + len - 1—could underflow when len was zero. Unsigned integer wraparound turned a “do nothing” request into a potential memory corruption vector.

The patch arrives alongside a broader set of GHCB hardening fixes, suggesting kernel maintainers were reviewing the entire confidential-guest communication surface. CVE-2026-63940 is the most severe of these, but the adjacent corrections are a reminder that confidential computing adds complexity right where attackers look: in the validation of untrusted inputs.

What to Do Now

If you manage Linux KVM hosts with AMD SEV enabled, here’s a concrete action plan.

  1. Inventory your environment. List every bare‑metal server that runs KVM, then filter for AMD processors with SEV support (you can check via lscpu and dmesg | grep -i sev). Not all AMD CPUs have SEV; some lower‑end or older models lack it.
  2. Identify active SEV guests. Hosts that run confidential VMs—especially those with regulatory or multi‑tenant workloads—should be patched first. Use your virtualization management tools to locate VMs configured with sev, sev-es, or sev-snp in their XML or configuration files.
  3. Obtain the fixed kernel. Rely on your distribution’s security channels. For example, Red Hat would ship a patched kernel via RHSA, Ubuntu via USN, and so on. Upstream fixed versions are:
    - 6.12.95 for the 6.12.x series
    - 6.18.35 for the 6.18.x series
    - 7.0.12 for the 7.0.x series
    - 7.1 or later for the mainline
    If you run a vendor‑supplied appliance or cloud instance (AWS Nitro, etc.), consult the vendor directly.
  4. Apply and reboot. Where possible, migrate VMs off the host, update the kernel package, and reboot. After booting, run uname -r and confirm the version matches your vendor’s advisory.
  5. Verify functionality. After the reboot, start a few test VMs, check network connectivity, storage paths, and any live‑migration return. A kernel update shouldn’t alter KVM’s basic behavior, but always test.
  6. Document and monitor. Record the patch event, the kernel version, and any compensating controls if patching is delayed. Keep an eye on NVD and vendor advisories for any updates to the CVE record, including NVD’s own CVSS score (which was still unpublished at the time of this article).

For hosts that absolutely cannot be patched immediately, tighten host access controls: limit who can create or reconfigure VMs, disable SEV‑ES/SNP for untrusted guests (if possible), and monitor for anomalous GHCB‑related kernel warnings. These are stopgap measures only—the fix remains the kernel update.

Outlook

CVE-2026-63940 is a textbook example of why boundary validation matters in security‑sensitive code. A zero‑length request is logically harmless, but in the absence of an explicit check it becomes a wedge. The kernel maintainers moved quickly, backporting the fix to multiple stable trees, and coordination with the Microsoft Security Response Center (MSRC) ensured that Windows users running on affected Linux hosts could be informed. However, the NVD had not supplied its own CVSS metrics as of July 20, 2026, meaning additional severity assessments may still appear.

What comes next is the patch deployment curve. Organizations with mature vulnerability management will have their hypervisors updated within days. Others will struggle with inventory gaps—not knowing which hosts even have SEV turned on. Every day an unpatched host runs confidential VMs, the risk of a guest‑to‑host escape, even a theoretical one, is a burden on the security team.

The broader lesson is that confidential computing does not eliminate the hypervisor attack surface—it re‑draws the perimeter. SEV‑SNP, for all its integrity guarantees, still relies on KVM to process GHCB requests correctly. As vendors roll out further hardening, administrators should couple kernel updates with regular audits of their virtualization stack. The next critical CVE may not give such a clear “patch and reboot” signal.