The Linux kernel vulnerability CVE-2026-64308 concerns the crypto CCP driver and improper initialization of SNP during ioctl(SNP_VLEK_LOAD). If SEV initialization fails while KVM is running VMs, a userspace process could invoke ioctls such as SEV_PDH_GEN to zero out the MSR_VM_HSAVE_PA register globally. This could lead to a general protection fault on the next VMRUN execution, crashing the host system. The vulnerability arises because the SNP_VLEK_LOAD ioctl previously allowed initialization even if SNP was not initialized, which was a no-op but a likely userspace mistake. The fix refuses to perform initialization unless SNP was previously initialized, returning -ENODEV to prevent misuse. This change breaks ABI compatibility but corrects the flawed behavior.

Exploitation could cause a host system crash due to a general protection fault triggered by zeroing out a critical MSR register used in virtual machine execution. This impacts system stability and availability but does not indicate direct privilege escalation or data compromise. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to refuse SNP initialization via ioctl(SNP_VLEK_LOAD) if SNP was not previously initialized, returning an error instead of performing a no-op. Users should update to the patched kernel versions once available. No additional mitigation is indicated.