Heap Corruption and Information Disclosure in Linux Kernel Virtualization

CVE-2026-53360

What is CVE-2026-53360?

A vulnerability exists in the Linux kernel related to KVM SEV-SNP that allows guest-controlled memory accesses to result in out-of-bounds reads and writes, leading to potential heap corruption and information disclosure. Specifically, the error arises when the guest sets parameters that exceed expected boundaries, causing the host to manipulate memory incorrectly. This vulnerability can lead to unauthorized access to sensitive information and manipulation of memory layout, posing significant security risks to systems relying on SR-IOV and SEV-SNP technologies. Exploiting this flaw allows attackers to read and write outside allocated memory regions, revealing valuable heap information, and could be leveraged to escalate further attacks.

References