CVE-2026-63937
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Use READ_ONCE() when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READ_ONCE()/WRITE_ONCE() for cases where KVM is writing (and not consuming the result!), as the guest isn't supposed to touch the buffer while it's being processed. I.e. using READ_ONCE() is all about protecting against misbehaving guests.
Affected versions
Linux kernel versions
6.11
and later are affected. Fixed in
6.12.93,
6.18.35,
7.0.12,
7.1
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-63937?
CVE-2026-63937 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.11 onward and has been patched in 6.12.93, 6.18.35, 7.0.12 and others. CVE-2026-63937 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-63937?
Yes — CVE-2026-63937 has been patched. Fixed versions include 6.12.93, 6.18.35, 7.0.12 and others. If you are running Linux kernel 6.11 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-63937 actively exploited?
No — CVE-2026-63937 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.