What is CVE-2026-52959?

CVE-2026-52959 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, affecting Linux kernel versions from 6.13.8 onward and patched in 6.18.33, 7.0.10 and 7.1. CVE-2026-52959 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-52959?

CVE-2026-52959 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-52959?

Yes, CVE-2026-52959 has been patched. Fixed versions include 6.18.33, 7.0.10 and 7.1. If you are running Linux kernel 6.13.8 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-52959 actively exploited?

CVE-2026-52959 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-52959

High

In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Do not use host-controlled page order in cleanup path When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST), get_ext_report() allocates a buffer to retrieve a certificate blob from the host, keeping track of its size in report_req->certs_len. However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating an invalid buffer size, as well as the expected length of such buffer. get_ext_report() subsequently updates report_req->certs_len with the host-controlled value, and cleans up the buffer by computing a page order from such value. This is incorrect, as the host-provided length may not match the page order of the original allocation, potentially resulting in corruption in the page allocator. Fix this by using alloc_pages_exact() instead, and reusing @npages to compute the size passed to free_pages_exact(). For consistency, also use @npages to compute the size when allocating the pages, even though this last change has no functional effect.

Package Linux Kernel

Published 2026-06-24

Last modified 2026-07-14

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Linux kernel versions 6.13.8, 6.14 and later are affected. Fixed in 6.18.33, 7.0.10, 7.1 and their respective stable series.

Affected from

≥ 6.13.8 ≥ 6.14

Fixed in

✓ 6.18.33 6.18.x ✓ 7.0.10 7.0.x ✓ 7.1

References

3 total

Kernel Git
https://git.kernel.org/stable/c/23e6a1ca04ae44806439a5a446e62e4d42e80bb4

Patch
Kernel Git
https://git.kernel.org/stable/c/3f6fb0211b39aaa1b841260681dd02ca6b693ed5

Patch
Kernel Git
https://git.kernel.org/stable/c/9e48b4f813d2c3db75d522aa82ab705ce04b7e2d

Patch

Details

CVE ID CVE-2026-52959

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2026-06-24

Modified 2026-07-14

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-52959?

CVE-2026-52959 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 . It affects Linux kernel versions from 6.13.8 onward and has been patched in 6.18.33, 7.0.10 and 7.1. CVE-2026-52959 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-52959?

CVE-2026-52959 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-52959?

Yes. CVE-2026-52959 has been patched. Fixed versions include 6.18.33, 7.0.10 and 7.1. If you are running Linux kernel 6.13.8 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-52959 actively exploited?

No. CVE-2026-52959 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.