Executive brief
A vulnerability in the Linux kernel's AMD Secure Nested Paging (SNP) support could allow a local user to crash the host operating system. By triggering specific commands when the security features are in an uninitialized state, an attacker could cause a critical processor error (General Protection Fault). This would result in a complete system outage, impacting all running virtual machines and services on the affected host.
Technical details
A vulnerability in the Linux kernel's crypto/ccp driver (specifically in sev-dev.c) allows a local userspace process to trigger a host crash via the SNP_CONFIG ioctl. If SEV-SNP initialization previously failed but KVM is actively running non-SNP virtual machines, calling this ioctl could cause the kernel to attempt a re-initialization that zeroes out the MSR_VM_HSAVE_PA register globally. This leads to a General Protection Fault and a kernel panic upon the next VMRUN execution. The fix prevents the SNP_CONFIG ioctl from implicitly attempting to move the device to an INIT state if it is not already initialized. Patches have been released for multiple stable kernel branches including 6.12.y, 6.18.y, and 7.1.y.
Affected products
- Linux Linux 6.12.75 to 6.12.97, 6.16, 6.18.39, 7.1.4
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory