What is the CVSS score of CVE-2026-64308?

CVE-2026-64308 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64308?

Yes, a patch is available for CVE-2026-64308. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64308

EUVD-2026-49020 MEDIUM

2026-07-25 Linux

GHSA-jg4q-h984-9pjc

Denial Of Service Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local /dev/sev access required (AV:L, PR:L); no confidentiality or integrity impact; host crash yields A:H only.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SUSE

4.4 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 04, 2026 - 13:24 vuln.today

CVSS changed

Sep 04, 2026 - 13:22 NVD

5.5 (MEDIUM)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:49 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 25, 2026 - 08:49 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)

Sashiko notes:

> if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash the > host?

The SEV firmware docs for SNP_VLEK_LOAD note:

> On SNP_SHUTDOWN, the VLEK is deleted.

That is, the initialization/shutdown wrapper here is pointless, because the firmware immediately throws away the key anyway. Instead, refuse to do anything if SNP has not been previously initialized.

This is an ABI break: before, this was a no-op and almost certainly a mistake by userspace, and now it returns -ENODEV. ABI compatibility could be maintained here by simply returning 0 in the check instead.

AnalysisAI

Uncontrolled SNP initialization in the Linux kernel's CCP/SEV driver allows a local low-privileged user with /dev/sev access to crash the host kernel on AMD SEV/SNP-capable systems running KVM. Sending a SNP_VLEK_LOAD ioctl when SNP has not been initialized triggers an unnecessary initialization/shutdown wrapper that zeros MSR_VM_HSAVE_PA globally; the subsequent VMRUN instruction for any active KVM guest then triggers a General Protection Fault, bringing down the host and terminating all co-hosted VMs. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects the specialized attack environment required.

Technical ContextAI

The vulnerability is in the AMD Cryptographic Co-Processor (CCP) driver's SEV/SNP subsystem (drivers/crypto/ccp) within the Linux kernel. AMD Secure Nested Paging (SNP) supports a VM Launch Encryption Key (VLEK) loaded via the SNP_VLEK_LOAD ioctl on /dev/sev. The handler was incorrectly wrapping this operation with SNP initialization and shutdown sequences. AMD firmware documentation confirms 'On SNP_SHUTDOWN, the VLEK is deleted,' making the wrapper both pointless (key immediately discarded) and dangerous: the initialization path zeros MSR_VM_HSAVE_PA - the Model-Specific Register holding the Host Save Area pointer required for VMRUN - across all CPUs. If called when SNP is uninitialized, any subsequent VMRUN instruction from an active KVM guest raises a General Protection Fault, crashing the host. CWE classification is not assigned, but the root cause is improper sequencing of privileged hardware initialization (closest to CWE-362 or CWE-665). CPE: cpe:2.3:a:linux:linux.

RemediationAI

Apply upstream stable kernel patches available at git.kernel.org: commit 61cf5eef20657bff9ca235fe938a99ce5ff65c06 (https://git.kernel.org/stable/c/61cf5eef20657bff9ca235fe938a99ce5ff65c06), 92567ed9306d5a3d1b007eb4faeff30cc3ffc3e4, 8836801847b9479ac046cb18a24981e1b0b05e9d, and f91e9dbb5845d1e5abf1028e6df57dcf61583e1b. Vendor-released patched versions confirmed by EUVD include Linux 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1. Note the ABI change: post-patch, SNP_VLEK_LOAD returns -ENODEV instead of 0 when SNP is not initialized; userspace SEV management tools (libvirt, sev-tool, QEMU SEV helpers) should be audited for this return code. As a compensating control on unpatched systems, restrict /dev/sev permissions to root-only via udev rules - this eliminates PR:L exploitation but may break legitimate SEV VM management workflows that rely on non-root access. Blacklisting the ccp module entirely eliminates the attack surface but also disables AMD hardware crypto acceleration.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected

CVE-2026-64308 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64308

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code