CVE-2026-52959

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> virt: sev-guest: Do not use host-controlled page order in cleanup path<br /> <br /> When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST),<br /> get_ext_report() allocates a buffer to retrieve a certificate blob from the<br /> host, keeping track of its size in report_req-&gt;certs_len.<br /> <br /> However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating<br /> an invalid buffer size, as well as the expected length of such buffer.<br /> get_ext_report() subsequently updates report_req-&gt;certs_len with the<br /> host-controlled value, and cleans up the buffer by computing a page order<br /> from such value. This is incorrect, as the host-provided length may not<br /> match the page order of the original allocation, potentially resulting<br /> in corruption in the page allocator.<br /> <br /> Fix this by using alloc_pages_exact() instead, and reusing @npages to<br /> compute the size passed to free_pages_exact(). For consistency, also<br /> use @npages to compute the size when allocating the pages, even though<br /> this last change has no functional effect.