CVE-2026-64308

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)<br /> <br /> Sashiko notes:<br /> <br /> &gt; if SEV initialization fails and KVM is actively running normal VMs, could a<br /> &gt; userspace process trigger this code path via /dev/sev ioctls (e.g.,<br /> &gt; SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN<br /> &gt; execution for an active VM trigger a general protection fault and crash the<br /> &gt; host?<br /> <br /> The SEV firmware docs for SNP_VLEK_LOAD note:<br /> <br /> &gt; On SNP_SHUTDOWN, the VLEK is deleted.<br /> <br /> That is, the initialization/shutdown wrapper here is pointless, because the<br /> firmware immediately throws away the key anyway. Instead, refuse to do<br /> anything if SNP has not been previously initialized.<br /> <br /> This is an ABI break: before, this was a no-op and almost certainly a<br /> mistake by userspace, and now it returns -ENODEV. ABI compatibility could be<br /> maintained here by simply returning 0 in the check instead.