← Back to CVE Explorer

CVE-2026-64310

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash the > host? sev_move_to_init_state() is called for ioctls requiring only SEV firmware: SEV_PEK_GEN, SEV_PDH_GEN, SEV_PEK_CSR, SEV_PEK_CERT_IMPORT, and SEV_PDH_CERT_EXPORT. After the firmware command, it does SEV_SHUTDOWN on the SEV firmware. Since these commands do not require SNP to be initialized, skip it by calling __sev_platform_init_locked() which only initializes the SEV firmware. This way SNP is not Initialized at all, and HSAVE_PA is not cleared. The previous code saved any SEV initialization firmware error to init_args.error and then threw it away and hardcoded the return value of INVALID_PLATFORM_STATE regardless of the real firmware error. This patch changes it to surface the underlying error, which is hopefully both more useful and doesn't cause any problems. Note that it is still safe to call __sev_firmware_shutdown() directly: it calls __sev_snp_shutdown_locked(), which skips SNP shutdown if SNP was not initialized.

Severity
MEDIUM
CVSS score
5.5 (v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-07-25 10:17:12.147000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON 
{
  "id": "CVE-2026-64310",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-07-25T10:17:12.147",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Do not initialize SNP for SEV ioctls\n\nSashiko notes:\n\n> if SEV initialization fails and KVM is actively running normal VMs, could a\n> userspace process trigger this code path via /dev/sev ioctls (e.g.,\n> SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN\n> execution for an active VM trigger a general protection fault and crash the\n> host?\n\nsev_move_to_init_state() is called for ioctls requiring only SEV firmware:\nSEV_PEK_GEN, SEV_PDH_GEN, SEV_PEK_CSR, SEV_PEK_CERT_IMPORT, and\nSEV_PDH_CERT_EXPORT. After the firmware command, it does SEV_SHUTDOWN on\nthe SEV firmware. Since these commands do not require SNP to be\ninitialized, skip it by calling __sev_platform_init_locked() which only\ninitializes the SEV firmware. This way SNP is not Initialized at all, and\nHSAVE_PA is not cleared.\n\nThe previous code saved any SEV initialization firmware error to\ninit_args.error and then threw it away and hardcoded the return value of\nINVALID_PLATFORM_STATE regardless of the real firmware error. This patch\nchanges it to surface the underlying error, which is hopefully both more\nuseful and doesn't cause any problems.\n\nNote that it is still safe to call __sev_firmware_shutdown() directly: it\ncalls __sev_snp_shutdown_locked(), which skips SNP shutdown if SNP was not\ninitialized."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\ncrypto: ccp - No inicializar SNP para ioctls de SEV\n\nNotas de Sashiko:\n\n> si la inicialización de SEV falla y KVM está ejecutando activamente VMs normales, ¿podría un\n> proceso de espacio de usuario activar esta ruta de código a través de ioctls de /dev/sev (p. ej.,\n> SEV_PDH_GEN) y poner a cero MSR_VM_HSAVE_PA globalmente? ¿La siguiente ejecución de VMRUN\n> para una VM activa activaría una falla de protección general y colapsaría el\n> host?\n\nsev_move_to_init_state() se llama para ioctls que requieren solo firmware de SEV:\nSEV_PEK_GEN, SEV_PDH_GEN, SEV_PEK_CSR, SEV_PEK_CERT_IMPORT y\nSEV_PDH_CERT_EXPORT. Después del comando de firmware, realiza SEV_SHUTDOWN en\nel firmware de SEV. Dado que estos comandos no requieren que SNP sea\ninicializado, se omite llamando a __sev_platform_init_locked() que solo\ninicializa el firmware de SEV. De esta manera, SNP no se inicializa en absoluto, y\nHSAVE_PA no se borra.\n\nEl código anterior guardaba cualquier error de firmware de inicialización de SEV en\ninit_args.error y luego lo descartaba y codificaba el valor de retorno de\nINVALID_PLATFORM_STATE independientemente del error real del firmware. Este parche\nlo cambia para mostrar el error subyacente, lo que, con suerte, es más\nútil y no causa ningún problema.\n\nTenga en cuenta que sigue siendo seguro llamar a __sev_firmware_shutdown() directamente:\nllama a __sev_snp_shutdown_locked(), que omite el apagado de SNP si SNP no fue\ninicializado."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/crypto/ccp/sev-dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "1c3506ea8599a3ad1b9aae5cbd573134f8d18db7",
              "lessThan": "5181e88da99c3d1d41e25db3472a62b8d4b42cdd",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ceac7fb89e8da465aec3ac3c20477f912f5c3a6c",
              "lessThan": "9e983d0a74a6a2348e4ce61647ec8a4dfbe198ac",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ceac7fb89e8da465aec3ac3c20477f912f5c3a6c",
              "lessThan": "d51207735e7c224cf591fa260c557a451a69a5cf",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ceac7fb89e8da465aec3ac3c20477f912f5c3a6c",
              "lessThan": "fb1758e74b8061aacfbce7bbb7a7cc650537e167",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6.12.75",
              "lessThan": "6.12.96",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/crypto/ccp/sev-dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.16",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.16",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.96",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.39",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.1.4",
              "lessThanOrEqual": "7.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.12.75",
              "versionEndExcluding": "6.12.96",
              "matchCriteriaId": "0C1E3642-D5B1-428A-9CC8-2B6059DEA06A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.16",
              "versionEndExcluding": "6.18.39",
              "matchCriteriaId": "FFBD7467-7FB0-4538-9CC0-98199E9EC402"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.19",
              "versionEndExcluding": "7.1.4",
              "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/5181e88da99c3d1d41e25db3472a62b8d4b42cdd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/9e983d0a74a6a2348e4ce61647ec8a4dfbe198ac",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/d51207735e7c224cf591fa260c557a451a69a5cf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/fb1758e74b8061aacfbce7bbb7a7cc650537e167",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}