Executive brief
A vulnerability in the Linux kernel's handling of AMD Secure Nested Paging (SEV-SNP) could allow a local user to crash the host system. By triggering a specific command when the security hardware is in an unexpected state, an attacker can cause a kernel panic or general protection fault. This impacts the availability of the server and all virtual machines running on it.
Technical details
A vulnerability in drivers/crypto/ccp/sev-dev.c in the Linux kernel arises from improper state validation during the SNP_COMMIT ioctl. If SEV-SNP initialization has previously failed, a local attacker with access to /dev/sev can trigger a code path that incorrectly attempts to initialize or transition the SNP state. This can result in zeroing out the MSR_VM_HSAVE_PA register globally. Consequently, the next VMRUN instruction executed by the KVM hypervisor for any active VM will trigger a general protection fault, leading to a complete host crash. The fix removes the unnecessary initialization check for the SNP_COMMIT command, as the firmware allows this command even in an uninitialized state.
Affected products
- Linux Linux 6.12.75 - 6.12.96, 6.16 - 6.18.39, 7.1.4
Timeline
- 2026-05-04: patched: Initial fix authored by AMD
- 2026-07-25: disclosed: CVE published to NVD