In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) Sashiko notes: > if… (CVE-2026-64308)
A vulnerability in the Linux kernel's crypto CCP driver related to SNP initialization for the ioctl SNP_VLEK_LOAD has been resolved. The issue involved improper handling of SNP initialization and shutdown, where the initialization was pointless because the firmware discards the key on shutdown. The fix changes behavior to refuse operations if SNP is not previously initialized, which breaks ABI compatibility by returning -ENODEV instead of a no-op. This vulnerability could potentially cause a general protection fault and host crash if exploited via /dev/sev ioctls when KVM is running VMs.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-64308 concerns the crypto CCP driver and its handling of SNP_VLEK_LOAD ioctl calls. Previously, the SNP initialization and shutdown wrapper was ineffective because the firmware deletes the VLEK on SNP_SHUTDOWN, making the initialization redundant. The vulnerability allowed a userspace process to trigger code paths that could zero out MSR_VM_HSAVE_PA globally if SEV initialization failed and KVM was running VMs, potentially causing a general protection fault and crashing the host. The patch changes the driver to refuse operations if SNP is not initialized, returning -ENODEV instead of performing a no-op, which introduces an ABI break.
Potential Impact
If exploited, a userspace process could trigger a code path that zeroes out a critical MSR register (MSR_VM_HSAVE_PA) globally, which may cause a general protection fault and crash the host running KVM virtual machines. This could lead to denial of service on the host system. No known exploits are reported in the wild.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel by changing the SNP_VLEK_LOAD ioctl behavior to refuse operations if SNP is not initialized, returning -ENODEV. Users should apply the official Linux kernel update that includes this fix. Since this is a kernel-level fix, updating to the patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the vendor advisory or Linux kernel release notes for the exact fixed versions and update accordingly.
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) Sashiko notes: > if… (CVE-2026-64308)
Description
A vulnerability in the Linux kernel's crypto CCP driver related to SNP initialization for the ioctl SNP_VLEK_LOAD has been resolved. The issue involved improper handling of SNP initialization and shutdown, where the initialization was pointless because the firmware discards the key on shutdown. The fix changes behavior to refuse operations if SNP is not previously initialized, which breaks ABI compatibility by returning -ENODEV instead of a no-op. This vulnerability could potentially cause a general protection fault and host crash if exploited via /dev/sev ioctls when KVM is running VMs.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-64308 concerns the crypto CCP driver and its handling of SNP_VLEK_LOAD ioctl calls. Previously, the SNP initialization and shutdown wrapper was ineffective because the firmware deletes the VLEK on SNP_SHUTDOWN, making the initialization redundant. The vulnerability allowed a userspace process to trigger code paths that could zero out MSR_VM_HSAVE_PA globally if SEV initialization failed and KVM was running VMs, potentially causing a general protection fault and crashing the host. The patch changes the driver to refuse operations if SNP is not initialized, returning -ENODEV instead of performing a no-op, which introduces an ABI break.
Potential Impact
If exploited, a userspace process could trigger a code path that zeroes out a critical MSR register (MSR_VM_HSAVE_PA) globally, which may cause a general protection fault and crash the host running KVM virtual machines. This could lead to denial of service on the host system. No known exploits are reported in the wild.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel by changing the SNP_VLEK_LOAD ioctl behavior to refuse operations if SNP is not initialized, returning -ENODEV. Users should apply the official Linux kernel update that includes this fix. Since this is a kernel-level fix, updating to the patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the vendor advisory or Linux kernel release notes for the exact fixed versions and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jg4q-h984-9pjc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64308"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420d9c2644c7f8085d09
Added to database: 07/25/2026, 23:09:01 UTC
Last enriched: 07/25/2026, 23:36:45 UTC
Last updated: 07/26/2026, 04:40:13 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.