The vulnerability (CVE-2026-64310) in the Linux kernel's crypto CCP subsystem concerns the initialization sequence for SEV ioctls. Previously, SNP was initialized even for SEV ioctls that do not require it, which could zero out the MSR_VM_HSAVE_PA register globally if SEV initialization failed. This could cause the next VMRUN execution to trigger a general protection fault and crash the host. The fix involves skipping SNP initialization for SEV ioctls that only require SEV firmware, thus preserving HSAVE_PA and preventing host crashes. The issue affects linux-hwe-edge kernel versions prior to 7.0.0-31.31 and related builds. The vulnerability has a CVSS 3.1 score of 5.5 (medium severity) with an impact on availability (host crash). No confidentiality or integrity impact is noted. A patch is available from Ubuntu as part of their Linux kernel security updates.

The vulnerability can cause a host system crash due to a general protection fault triggered by improper clearing of the MSR_VM_HSAVE_PA register during SEV ioctl operations. This impacts system availability but does not affect confidentiality or integrity. There is no indication of privilege escalation or data compromise from this specific flaw. The issue is local and requires low privileges to exploit (local attacker with access to /dev/sev ioctls).

A patch is available and should be applied by updating to the fixed Linux kernel versions provided by Ubuntu. The vendor advisory confirms that the issue is resolved in linux-hwe-edge kernel versions 7.0.0-31.31 and later. After updating, a system reboot is required. No additional mitigation steps are necessary as the patch fully addresses the vulnerability.