CVE-2026-72286

Received Received - Intake

KVM SEV-SNP VM Migration Rejection Due to Missing State

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. The proper migration requires additional SNP-specific state such as guest_req_mutex, guest_req_buf, and guest_resp_buf to be transferred or initialized on the destination. The SNP VM mirroring requires vmsa features to be copied as well otherwise ASID would be bound to SNP range while VM is detected as a SEV VM. Reject SNP source VMs in migration/mirroring until proper SNP state transfer is implemented. [sean: let lines poke past 80 chars, tag for stable]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72286

EUVD

EUVD-2026-59185

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves Secure Encrypted Virtualization (SEV) for AMD processors. It prevents intra-host migration or mirroring of SEV-SNP (Secure Nested Paging) virtual machines due to incomplete state transfer requirements. The missing state includes critical components like guest_req_mutex, guest_req_buf, and guest_resp_buf, which are necessary for proper migration. Without these, the destination host cannot correctly initialize the VM, leading to potential security or functionality issues.

Detection Guidance

This vulnerability is specific to KVM and SEV-SNP VMs in the Linux kernel. Detection requires checking kernel logs for migration/mirroring attempts of SEV-SNP VMs. Use commands like 'dmesg | grep -i sev' or 'journalctl -k | grep -i sev' to inspect kernel messages for SEV-related errors or rejections.

Impact Analysis

If you use SEV-SNP virtual machines on a Linux system, this vulnerability could prevent you from migrating or mirroring these VMs within the same host. This may disrupt operations requiring VM duplication or failover, potentially causing downtime or data access issues. However, it does not directly expose data or allow unauthorized access.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar regulations since it does not involve data breaches or unauthorized access. However, if your operations rely on SEV-SNP VM migration for redundancy or failover, the inability to migrate could affect availability requirements under these standards, potentially leading to compliance issues if service levels are not met.

Mitigation Strategies

Disable intra-host migration/mirroring of SEV-SNP VMs until the kernel is updated. Avoid using this feature for SEV-SNP VMs. Monitor kernel updates for a fix addressing the missing SNP state transfer during migration.

Hi! I’m here to help you understand CVE-2026-72286. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70