The vulnerability (CVE-2026-72239) in the Linux kernel concerns the x86/virt/sev code path where the sequence of cache flushing (WBINVD) and setting the MSR_AMD64_SYSCFG_SNP_EN register was incorrect. The original commit dropped WBINVD before setting the register, but this introduced a race condition where dirty cache lines could be moved between CPUs and not flushed properly, violating the SNP specification which requires all CPUs to have clean caches for the memory containing the RMP table before initialization. The fix reverts this commit, ensuring that the cache flush (wbinvd_on_all_cpus()) happens before enabling SNP, thus maintaining compliance with the SNP spec and preventing potential memory protection issues.

If unpatched, the race condition could allow dirty cache lines to remain unflushed during SNP initialization, potentially violating firmware requirements and undermining memory protection guarantees. This could affect the security guarantees of Secure Nested Paging on AMD SEV-enabled systems, possibly leading to memory integrity issues. However, no known exploits are reported in the wild.

A fix has been applied by reverting the problematic commit to ensure proper cache flushing before enabling SNP. Users should update their Linux kernel to a version that includes this revert to mitigate the vulnerability. Since this is a kernel-level fix, applying the official kernel update from the vendor or distribution is the recommended remediation. Patch status is confirmed by the revert commit; no additional mitigation steps are indicated.