CVE-2026-64309

Analyzed Analyzed - Analysis Complete

Linux Kernel SEV-SNP SNP_COMMIT State Handling Issue

Publication date: 2026-07-25

Last updated on: 2026-09-04

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash the > host? The SNP_COMMIT command does not require the firmware to be in any particular state. Skip initializing it if it was previously uninitialized. The SEV-SNP firmware specification doc 56860 does not mention SNP_COMMIT in Table 5 as a command that is allowed in the UNINIT state, but it is in fact allowed and a future documentation update will reflect that.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-04

Generated

2026-09-24

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64309

EUVD

EUVD-2026-49021

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 6.16 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.12.75 (inc) to 6.12.96 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the SNP_COMMIT command in the SEV-SNP (Secure Encrypted Virtualization-Secure Nested Paging) feature. The issue arises when SEV initialization fails but KVM is running normal VMs. A userspace process could trigger this via /dev/sev ioctls, potentially zeroing out MSR_VM_HSAVE_PA globally. This might cause a general protection fault during the next VMRUN execution, crashing the host system.

Detection Guidance

This vulnerability is specific to the Linux kernel's crypto subsystem and SEV-SNP functionality. Detection would require checking kernel logs for SEV initialization failures or ioctl errors related to /dev/sev. Monitor for general protection faults or crashes during VMRUN execution. No direct commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could lead to a system crash due to a general protection fault. This would disrupt all running VMs and potentially cause data loss or denial of service. Systems relying on SEV-SNP for security may also experience compromised isolation between VMs.

Compliance Impact

The provided CVE data does not specify any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability relates to SEV-SNP initialization in the Linux kernel, which could potentially cause system instability or crashes if exploited. However, no explicit compliance implications are mentioned.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the SEV-SNP initialization issue. Ensure SEV-SNP is properly initialized before running KVM VMs. Monitor for SEV-related errors in kernel logs.

Hi! I’m here to help you understand CVE-2026-64309. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70