CVE-2026-64308
Received Received - Intake

SEV SNP VLEK Load Failure in Linux Kernel

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash the > host? The SEV firmware docs for SNP_VLEK_LOAD note: > On SNP_SHUTDOWN, the VLEK is deleted. That is, the initialization/shutdown wrapper here is pointless, because the firmware immediately throws away the key anyway. Instead, refuse to do anything if SNP has not been previously initialized. This is an ABI break: before, this was a no-op and almost certainly a mistake by userspace, and now it returns -ENODEV. ABI compatibility could be maintained here by simply returning 0 in the check instead.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64308
EUVD
EUVD-2026-49020

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the CCP (Cryptographic Coprocessor) component. The issue occurs when SEV (Secure Encrypted Virtualization) initialization fails but KVM (Kernel-based Virtual Machine) is running normal VMs. A userspace process could trigger the code path via /dev/sev ioctls, potentially zeroing out MSR_VM_HSAVE_PA globally. This might cause a general protection fault and crash the host during the next VMRUN execution for an active VM.

Detection Guidance

This vulnerability is specific to the Linux kernel's crypto subsystem and SEV (Secure Encrypted Virtualization) functionality. Detection requires checking kernel logs for SEV-related errors or examining the crypto CCP (Coherent Processing Platform) driver behavior. No direct network detection commands are applicable.

Impact Analysis

If exploited, this vulnerability could lead to a system crash or denial of service by causing a general protection fault during VM execution. It may also allow privilege escalation if an attacker can manipulate MSR_VM_HSAVE_PA, potentially affecting other VMs or the host system.

Compliance Impact

This vulnerability could impact compliance by causing system instability or crashes, leading to potential data loss or unauthorized access. For GDPR, it may affect availability of personal data processing systems. For HIPAA, it could disrupt secure virtualized environments handling protected health information.

Mitigation Strategies

Apply the latest kernel patch that resolves this issue. Monitor kernel logs for SEV initialization failures. If SEV is not actively used, consider disabling it via kernel parameters. Ensure userspace applications do not attempt SNP_VLEK_LOAD ioctls until SNP is properly initialized.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64308. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart