Executive brief
A vulnerability in the Linux kernel's AMD Secure Processor driver could allow a local user to crash the host system. By sending specific commands to the hardware encryption component, an attacker could trigger a critical processor error that halts the entire server. This affects systems using AMD Secure Encrypted Virtualization (SEV) and could lead to a total service outage for all virtual machines on the host.
Technical details
A vulnerability exists in the Linux kernel's AMD CCP driver (drivers/crypto/ccp/sev-dev.c) where the SNP_VLEK_LOAD ioctl incorrectly attempts to initialize Secure Nested Paging (SNP) even if it was not previously active. If SEV initialization has failed but KVM is running standard virtual machines, a local userspace process can trigger this code path via /dev/sev ioctls. This can result in the global zeroing of the MSR_VM_HSAVE_PA register, causing the next VMRUN execution to trigger a general protection fault and a subsequent host kernel panic. The fix ensures the driver refuses the operation if SNP has not been previously initialized.
Affected products
- Linux Linux Kernel 6.12.75 to 6.12.96, 6.16, 6.18.39, 7.1.4
Timeline
- 2026-05-04: other: Patch authored
- 2026-07-25: disclosed: CVE published