Executive brief
A vulnerability in the Linux kernel's AMD Secure Encrypted Virtualization (SEV) component could allow a local user to crash the host system. By triggering specific commands through the SEV device, an attacker can cause the system to incorrectly clear internal processor registers used for virtualization. This results in a kernel panic or host crash when the system attempts to run any virtual machine.
Technical details
The vulnerability exists in the `sev_move_to_init_state()` function within `drivers/crypto/ccp/sev-dev.c`. When processing certain SEV ioctls (such as SEV_PDH_GEN), the kernel unnecessarily attempts to initialize Secure Nested Paging (SNP) even when only standard SEV firmware is required. If SEV initialization fails while KVM is running active VMs, a local userspace process can trigger this path via `/dev/sev` to zero out the `MSR_VM_HSAVE_PA` register globally. Subsequent `VMRUN` instructions on the host will then trigger a general protection fault, leading to a host crash. The fix involves using `__sev_platform_init_locked()` to initialize only the SEV firmware and skip SNP initialization for these specific ioctls.
Affected products
- Linux Linux Kernel 6.12.75 to 6.12.96, 6.16, 6.18.39
Timeline
- 2026-05-04: other: Patch authored
- 2026-07-25: disclosed: CVE published