PT-2026-64531 · Linux · Linux

CVE-2026-64310

·

Publicado

2026-07-25

·

Atualizado

2026-07-25

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - Do not initialize SNP for SEV ioctls
Sashiko notes:
if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls (e.g., SEV PDH GEN) and zero out MSR VM HSAVE PA globally? Would the next VMRUN execution for an active VM trigger a general protection fault and crash the host?
sev move to init state() is called for ioctls requiring only SEV firmware: SEV PEK GEN, SEV PDH GEN, SEV PEK CSR, SEV PEK CERT IMPORT, and SEV PDH CERT EXPORT. After the firmware command, it does SEV SHUTDOWN on the SEV firmware. Since these commands do not require SNP to be initialized, skip it by calling sev platform init locked() which only initializes the SEV firmware. This way SNP is not Initialized at all, and HSAVE PA is not cleared.
The previous code saved any SEV initialization firmware error to init args.error and then threw it away and hardcoded the return value of INVALID PLATFORM STATE regardless of the real firmware error. This patch changes it to surface the underlying error, which is hopefully both more useful and doesn't cause any problems.
Note that it is still safe to call sev firmware shutdown() directly: it calls sev snp shutdown locked(), which skips SNP shutdown if SNP was not initialized.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64310

Produtos afetados

Linux