CVE-2026-64309

Summary

In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)

Sashiko notes:

> if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash the > host?

The SNP_COMMIT command does not require the firmware to be in any particular state. Skip initializing it if it was previously uninitialized.

The SEV-SNP firmware specification doc 56860 does not mention SNP_COMMIT in Table 5 as a command that is allowed in the UNINIT state, but it is in fact allowed and a future documentation update will reflect that.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux1c3506ea8599a3ad1b9aae5cbd573134f8d18db7 < 74768f73854d647a6462f252dc8782ab8a835211affected
LinuxLinuxceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 7a361c74bb12f3398c388905f1d325be642cd36eaffected
LinuxLinuxceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 67ed191b4c8bdf432a3f32d1eb302880b4795cd1affected
LinuxLinuxceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 5a1364da2f04217a36e2fdfa2db4ee025b383a20affected
LinuxLinux6.12.75 < 6.12.96affected
LinuxLinux6.16affected
LinuxLinux0 < 6.16unaffected
LinuxLinux6.12.96 <= 6.12.*unaffected
LinuxLinux6.18.39 <= 6.18.*unaffected
LinuxLinux7.1.4 <= 7.1.*unaffected
LinuxLinux7.2-rc1 <= *unaffected

Weaknesses

References