Executive brief
The Linux kernel's KVM hypervisor has a memory allocation issue when handling encrypted virtual machine operations on AMD SEV/SEV-ES guests running on SNP-enabled servers. When encrypting or decrypting guest memory, KVM may use a temporary buffer allocated from a shared page, allowing other kernel code to simultaneously access and modify the same page. This causes RMP (Reverse Map Protection) violations when the page is transferred to firmware ownership, resulting in kernel panics and system crashes that disrupt virtualized workloads.
Technical details
The vulnerability is a memory allocation race condition in KVM's SEV/SEV-ES implementation on SNP-enabled AMD platforms. When performing ENCRYPT/DECRYPT operations via temporary buffers, KVM must transfer page ownership to firmware as required by the SNP architecture. However, if the temporary buffer is allocated as a sub-page allocation, other kernel subsystems can concurrently allocate and access the remaining portions of the same page. This causes RMP #PF (page fault) violations when software attempts to access firmware-owned memory, manifesting as kernel panics with "unable to handle page fault" and RMP violation errors. The fix allocates full 4KiB pages for temporary buffers to ensure exclusive page ownership by KVM during encryption/decryption operations, preventing concurrent access by other kernel code.
Affected products
- Linux Linux kernel 7.1.0 and likely earlier versions (fixed in later patches)
Timeline
- 2026-09-04: disclosed