Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if… (CVE-2026-64309)
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash the > host? The SNP_COMMIT command does not require the firmware to be in any particular state. Skip initializing it if it was previously uninitialized. The SEV-SNP firmware specification doc 56860 does not mention SNP_COMMIT in Table 5 as a command that is allowed in the UNINIT state, but it is in fact allowed and a future documentation update will reflect that.
AI Analysis
Technical Summary
The Linux kernel crypto CCP driver had a vulnerability where the SNP_COMMIT ioctl command could trigger initialization of SNP even when the SEV firmware was uninitialized. This could cause zeroing out of MSR_VM_HSAVE_PA, potentially leading to a general protection fault and crashing the host during VM execution. The SEV-SNP firmware specification does not list SNP_COMMIT as allowed in the UNINIT state, but it is allowed in practice. The patch resolves this by skipping SNP initialization if it was previously uninitialized, preventing the fault.
Potential Impact
If exploited, a userspace process could trigger a host crash by causing a general protection fault during VM execution. This could affect the stability of hosts running KVM with SEV-enabled VMs. No known exploits are reported in the wild.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to skip SNP initialization for the SNP_COMMIT ioctl if it was previously uninitialized, preventing the host crash. Users should apply the updated kernel versions provided by their Linux distribution to remediate this vulnerability.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if… (CVE-2026-64309)
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash the > host? The SNP_COMMIT command does not require the firmware to be in any particular state. Skip initializing it if it was previously uninitialized. The SEV-SNP firmware specification doc 56860 does not mention SNP_COMMIT in Table 5 as a command that is allowed in the UNINIT state, but it is in fact allowed and a future documentation update will reflect that.
CVSS v3.1
Score 5.5medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel crypto CCP driver had a vulnerability where the SNP_COMMIT ioctl command could trigger initialization of SNP even when the SEV firmware was uninitialized. This could cause zeroing out of MSR_VM_HSAVE_PA, potentially leading to a general protection fault and crashing the host during VM execution. The SEV-SNP firmware specification does not list SNP_COMMIT as allowed in the UNINIT state, but it is allowed in practice. The patch resolves this by skipping SNP initialization if it was previously uninitialized, preventing the fault.
Potential Impact
If exploited, a userspace process could trigger a host crash by causing a general protection fault during VM execution. This could affect the stability of hosts running KVM with SEV-enabled VMs. No known exploits are reported in the wild.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to skip SNP initialization for the SNP_COMMIT ioctl if it was previously uninitialized, preventing the host crash. Users should apply the updated kernel versions provided by their Linux distribution to remediate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8w5v-46pm-6rg4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64309"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420e9c2644c7f8086017
Added to database: 07/25/2026, 23:09:02 UTC
Last enriched: 08/15/2026, 03:10:47 UTC
Last updated: 09/07/2026, 16:07:56 UTC
Views: 42
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.