Heap out‑of‑bounds bug in KVM’s SEV‑SNP handler lets VM read/write host memory
An unchecked entry count in KVM’s SEV‑SNP Page State Change handler allows a malicious guest to overrun a host‑allocated buffer, enabling arbitrary kernel‑heap reads and writes. The flaw (CVE‑2026‑53360) affects all kernels with SNP PSC support since v6.10 and was patched in v7.0.12, v6.18.35, v6.12.93.