CVE-2026-64104: virt: sev-guest: Explicitly leak pages in unknown state

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

virt: sev-guest: Explicitly leak pages in unknown state

When set_memory_{encrypted,decrypted}() fail, the user cannot know at which
point the function failed, meaning that the pages are left in an unknown state
from the point of view of the caller.

Since the pages may be left in an unencrypted state, they are not suitable for
general use, and cannot be returned safely to the buddy allocator. Avoid the
issue by never freeing the pages, and then do the proper accounting by calling
snp_leak_pages().

The Linux kernel CVE team has assigned CVE-2026-64104 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.14 with commit 3e385c0d6ce88ac9916dcf84267bd5855d830748 and fixed in 6.18.34 with commit bee400ad4f4259c9c0758e4f1960a1eed6f6f9f0
	Issue introduced in 6.14 with commit 3e385c0d6ce88ac9916dcf84267bd5855d830748 and fixed in 7.0.11 with commit 3d0cd0065deeb054b4b29236432e851806b7cc81
	Issue introduced in 6.14 with commit 3e385c0d6ce88ac9916dcf84267bd5855d830748 and fixed in 7.1 with commit fd948c3f96b18ff9ba7d3e8eae13d196593e1aaf
	Issue introduced in 6.13.8 with commit 0b16521f95c875e79d657cb8d6911c15080dbb80

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64104
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/virt/coco/sev-guest/sev-guest.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/bee400ad4f4259c9c0758e4f1960a1eed6f6f9f0
	https://git.kernel.org/stable/c/3d0cd0065deeb054b4b29236432e851806b7cc81
	https://git.kernel.org/stable/c/fd948c3f96b18ff9ba7d3e8eae13d196593e1aaf