CVE-2026-64310

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: ccp - Do not initialize SNP for SEV ioctls<br /> <br /> Sashiko notes:<br /> <br /> &gt; if SEV initialization fails and KVM is actively running normal VMs, could a<br /> &gt; userspace process trigger this code path via /dev/sev ioctls (e.g.,<br /> &gt; SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN<br /> &gt; execution for an active VM trigger a general protection fault and crash the<br /> &gt; host?<br /> <br /> sev_move_to_init_state() is called for ioctls requiring only SEV firmware:<br /> SEV_PEK_GEN, SEV_PDH_GEN, SEV_PEK_CSR, SEV_PEK_CERT_IMPORT, and<br /> SEV_PDH_CERT_EXPORT. After the firmware command, it does SEV_SHUTDOWN on<br /> the SEV firmware. Since these commands do not require SNP to be<br /> initialized, skip it by calling __sev_platform_init_locked() which only<br /> initializes the SEV firmware. This way SNP is not Initialized at all, and<br /> HSAVE_PA is not cleared.<br /> <br /> The previous code saved any SEV initialization firmware error to<br /> init_args.error and then threw it away and hardcoded the return value of<br /> INVALID_PLATFORM_STATE regardless of the real firmware error. This patch<br /> changes it to surface the underlying error, which is hopefully both more<br /> useful and doesn&amp;#39;t cause any problems.<br /> <br /> Note that it is still safe to call __sev_firmware_shutdown() directly: it<br /> calls __sev_snp_shutdown_locked(), which skips SNP shutdown if SNP was not<br /> initialized.