In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if… (CVE-2026-64309)
A vulnerability in the Linux kernel's crypto CCP driver related to the SEV-SNP firmware handling has been resolved. The issue involves improper initialization of SNP during the ioctl(SNP_COMMIT) command, which does not require the firmware to be in any specific state. The vulnerability could potentially cause a general protection fault and crash the host if certain conditions occur. The Linux kernel has been updated to skip initializing SNP if it was previously uninitialized, aligning with the actual allowed commands in the SEV-SNP firmware specification.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-64309 concerns the crypto CCP driver and its handling of the SNP_COMMIT ioctl command. The SNP_COMMIT command is allowed even when the firmware is in an uninitialized state, contrary to earlier documentation. Previously, the kernel code would initialize SNP during this command, which could lead to issues if SEV initialization failed but KVM was running normal VMs. This could allow a userspace process to trigger code paths that zero out MSR_VM_HSAVE_PA globally, potentially causing a general protection fault and crashing the host during VMRUN execution. The fix involves skipping SNP initialization if it was previously uninitialized, reflecting the correct firmware behavior.
Potential Impact
If exploited, this vulnerability could cause a general protection fault leading to a host crash when running virtual machines under KVM with SEV-SNP enabled. This could result in denial of service for the host system. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by skipping SNP initialization during the SNP_COMMIT ioctl if it was previously uninitialized. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation.
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if… (CVE-2026-64309)
Description
A vulnerability in the Linux kernel's crypto CCP driver related to the SEV-SNP firmware handling has been resolved. The issue involves improper initialization of SNP during the ioctl(SNP_COMMIT) command, which does not require the firmware to be in any specific state. The vulnerability could potentially cause a general protection fault and crash the host if certain conditions occur. The Linux kernel has been updated to skip initializing SNP if it was previously uninitialized, aligning with the actual allowed commands in the SEV-SNP firmware specification.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-64309 concerns the crypto CCP driver and its handling of the SNP_COMMIT ioctl command. The SNP_COMMIT command is allowed even when the firmware is in an uninitialized state, contrary to earlier documentation. Previously, the kernel code would initialize SNP during this command, which could lead to issues if SEV initialization failed but KVM was running normal VMs. This could allow a userspace process to trigger code paths that zero out MSR_VM_HSAVE_PA globally, potentially causing a general protection fault and crashing the host during VMRUN execution. The fix involves skipping SNP initialization if it was previously uninitialized, reflecting the correct firmware behavior.
Potential Impact
If exploited, this vulnerability could cause a general protection fault leading to a host crash when running virtual machines under KVM with SEV-SNP enabled. This could result in denial of service for the host system. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by skipping SNP initialization during the SNP_COMMIT ioctl if it was previously uninitialized. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8w5v-46pm-6rg4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64309"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420e9c2644c7f8086017
Added to database: 07/25/2026, 23:09:02 UTC
Last enriched: 07/25/2026, 23:37:16 UTC
Last updated: 07/26/2026, 03:54:47 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.