I found a KVM guest-to-host heap corruption bug and someone else got there first

TLDR I independently found a heap out-of-bounds read/write in KVM&rsquo;s SEV-SNP Page State Change handler. A malicious guest VM can corrupt host kernel heap memory and leak its layout, across the VM boundary, as many times as it wants. I reported it to security@kernel.org on May 9, 2026 and they told me someone else reported it a few weeks earlier. This post is the story of that bug, why my fix…