CVE-2026-64307 addresses a flaw in the Linux kernel's crypto CCP subsystem where SNP initialization could be retried improperly during ioctl(SNP_CONFIG) calls. If SEV initialization fails while KVM is running VMs, a userspace process might trigger this code path and zero out MSR_VM_HSAVE_PA globally, potentially causing the next VMRUN execution to crash the host with a general protection fault. The fix refuses to retry initialization if SNP is not already initialized, preventing this unsafe state. This change introduces an ABI break requiring recompilation of third-party kernel modules. The vulnerability affects Linux kernel versions prior to 7.0.0-31.31 and related builds in the linux-hwe-edge package. The issue is patched in updated Ubuntu kernel packages as detailed in Ubuntu Security Notices USN-8726-1 and USN-8727-1.

The vulnerability can cause a denial of service by crashing the host system due to a general protection fault triggered during VM execution. There is no indication of confidentiality or integrity impact. The CVSS score is 5.5 (medium severity) with an attack vector of local, requiring low privileges and no user interaction. No known exploits are reported in the wild.

A patch is available and included in updated Linux kernel packages for Ubuntu 24.04 LTS and related releases. Users should update their systems to the specified package versions and reboot to apply the fix. Due to an ABI change, all third-party kernel modules must be recompiled and reinstalled after the update. Follow the vendor advisory instructions for updating and recompiling kernel modules to fully remediate the vulnerability.