Executive brief
A flaw in Linux kernel's KVM (Kernel Virtual Machine) virtualization code affects systems running AMD SEV-SNP secure virtual machines. When guest memory pages backing the VMSA (Virtual Machine Save Area) are deallocated or moved, the kernel fails to properly invalidate them, preventing firmware from reclaiming the pages and potentially causing system crashes or unexpected behavior on the next use.
Technical details
This is a KVM-SEV resource state management issue affecting AMD SEV-SNP virtual machines. The vulnerable component is the gmem_invalidate_range() handling in the KVM hypervisor code, which fails to forcefully invalidate the SNP VMSA when its backing guest_memfd page is being zapped (deallocated via PUNCH_HOLE) or when memslots are deleted/moved. The vulnerability requires local access and occurs when a VMSA page that is still marked in-use by the RMP (Reverse Map Protection) table is freed, causing RMPUPDATE failures (error code 3, FAIL_INUSE) and subsequent RMP page faults. The fix wires up proper gmem invalidation handlers to snapshot and recheck VMSA invalidation sequences, similar to VMX APIC-access page handling, and ensures VMSA mappings are invalidated when memslots disappear.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-16: disclosed