CVE-2026-64309 Details
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash the > host? The SNP_COMMIT command does not require the firmware to be in any particular state. Skip initializing it if it was previously uninitialized. The SEV-SNP firmware specification doc 56860 does not mention SNP_COMMIT in Table 5 as a command that is allowed in the UNINIT state, but it is in fact allowed and a future documentation update will reflect that.
A vulnerability exists in the Linux kernel's crypto CCP driver related to the handling of the SNP_COMMIT ioctl command. This issue can arise if SEV initialization fails while KVM is running normal virtual machines. In such cases, a userspace process could potentially exploit the vulnerability by using the /dev/sev ioctls, such as SEV_PDH_GEN, to overwrite the MSR_VM_HSAVE_PA register globally. This could lead to a general protection fault during the next VMRUN execution for an active VM, causing the host to crash. The vulnerability stems from the SNP_COMMIT command being allowed in an uninitialized state, contrary to the SEV-SNP firmware specification, which will be updated to reflect this allowance.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. The specific commit that fixes this issue is available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/5a1364da2f04217a36e2fdfa2db4ee025b383a20 | kernel.org | Patch |
| https://git.kernel.org/stable/c/67ed191b4c8bdf432a3f32d1eb302880b4795cd1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/74768f73854d647a6462f252dc8782ab8a835211 | kernel.org | Patch |
| https://git.kernel.org/stable/c/7a361c74bb12f3398c388905f1d325be642cd36e | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.12.75, < 6.12.96 >= 6.16, < 6.18.39 >= 6.19, < 7.1.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | Initial Analysis | [email protected] |
| Aug 17, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |