PT-2026-64531 · Linux · Linux
CVE-2026-64310
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - Do not initialize SNP for SEV ioctls
Sashiko notes:
if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls (e.g., SEV PDH GEN) and zero out MSR VM HSAVE PA globally? Would the next VMRUN execution for an active VM trigger a general protection fault and crash the host?
sev move to init state() is called for ioctls requiring only SEV firmware:
SEV PEK GEN, SEV PDH GEN, SEV PEK CSR, SEV PEK CERT IMPORT, and
SEV PDH CERT EXPORT. After the firmware command, it does SEV SHUTDOWN on
the SEV firmware. Since these commands do not require SNP to be
initialized, skip it by calling sev platform init locked() which only
initializes the SEV firmware. This way SNP is not Initialized at all, and
HSAVE PA is not cleared.
The previous code saved any SEV initialization firmware error to
init args.error and then threw it away and hardcoded the return value of
INVALID PLATFORM STATE regardless of the real firmware error. This patch
changes it to surface the underlying error, which is hopefully both more
useful and doesn't cause any problems.
Note that it is still safe to call sev firmware shutdown() directly: it
calls sev snp shutdown locked(), which skips SNP shutdown if SNP was not
initialized.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux