CVE-2023-53996: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53996 is a vulnerability in the Linux kernel's x86/SEV (Secure Encrypted Virtualization) subsystem, specifically in the enc_dec_hypercall() function. The function incorrectly accepted a page count (npages) instead of a byte size, forcing callers to round up non-page-aligned virtual addresses. This caused pages to be spuriously marked as decrypted via the encryption status hypercall, leading to consistent page corruption during live migration of SEV-protected virtual machines. The vulnerability affects Linux kernel versions from 5.16 up to (but not including) the patched stable releases. It was published on December 24, 2025, and no CVSS score has been assigned by NVD at this time (NVD, EUVD).

The root cause is an incorrect parameter type in enc_dec_hypercall() within the Linux kernel's x86/sev code path. When callers passed non-page-aligned virtual addresses, the function rounded up to the nearest page boundary, causing extra pages beyond the intended range to be incorrectly reported as decrypted to the hypervisor via the encryption status hypercall. This inaccurate encryption metadata caused the hypervisor to migrate pages from the wrong memory perspective during live migration, resulting in memory corruption. The fix changes the function signature to accept a byte size rather than a page count, allowing precise calculation of the affected memory range without spurious rounding. No CWE classification has been formally assigned, but the issue is consistent with incorrect calculation or off-by-one logic in memory management (related to CWE-682: Incorrect Calculation) (NVD).

The primary impact is data integrity loss in SEV-protected virtual machines during live migration: pages are consistently corrupted because the hypervisor migrates them from an incorrect memory perspective due to inaccurate encryption status reporting. This can cause guest OS instability, application crashes, or data corruption in cloud or virtualized environments using AMD SEV. Confidentiality impact is indirect — while the bug does not directly expose data, incorrect decryption status could theoretically cause sensitive encrypted pages to be handled as plaintext by the hypervisor. Availability is also affected, as live migration failures or guest crashes can disrupt service continuity (NVD, EUVD).

The Linux kernel has been patched in multiple stable branches. Fixed versions include kernel 6.1.53, 6.4.16, 6.5.3, and 6.6 and later. The relevant upstream commits are 6615212d8e13, 8ae7457e71a3, ac3f9c9f1b37, and ba50e7773a99 on the stable kernel tree. Administrators running SEV-enabled virtualization workloads with live migration should update to a patched kernel version as soon as possible. SUSE has also issued advisories (SUSE-2026-0281-1 and SUSE-2026-20876-1) incorporating these fixes (NVD, Linux Security).