Skip to main content

Linux Kernel CVE-2026-64309

| EUVDEUVD-2026-49021 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-07-25 Linux GHSA-8w5v-46pm-6rg4
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access to /dev/sev with low privilege required; no confidentiality or integrity impact; host crash achievable without user interaction.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 04, 2026 - 13:08 vuln.today
CVSS changed
Sep 04, 2026 - 13:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:49 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:49 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)

Sashiko notes:

> if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash the > host?

The SNP_COMMIT command does not require the firmware to be in any particular state. Skip initializing it if it was previously uninitialized.

The SEV-SNP firmware specification doc 56860 does not mention SNP_COMMIT in Table 5 as a command that is allowed in the UNINIT state, but it is in fact allowed and a future documentation update will reflect that.

AnalysisAI

Crash of a Linux KVM host is achievable by a local low-privileged user via the /dev/sev ioctl interface on systems running AMD SEV-SNP firmware. When SNP_COMMIT is issued after a prior failed SEV initialization, the crypto/ccp driver incorrectly proceeds with SNP initialization, zeroing out MSR_VM_HSAVE_PA - the model-specific register holding the AMD SVM host save-area pointer. Any subsequent VMRUN instruction by KVM for an already-running VM will generate a General Protection Fault, crashing the host and terminating all guest workloads. No public exploit has been identified at time of analysis; patch commits are available across multiple stable branches.

Technical ContextAI

The AMD Cryptographic Co-Processor (ccp) driver in the Linux kernel manages the SEV (Secure Encrypted Virtualization) and SEV-SNP (Secure Nested Paging) firmware lifecycle through the /dev/sev character device. The SNP_COMMIT ioctl is used to commit firmware to a new version state; it does not nominally require the firmware to be in an initialized state per AMD firmware specification doc 56860 (though Table 5 previously omitted this clarification, corrected in a forthcoming documentation update). The root cause is CWE-908 (Use of Uninitialized Resource): when SEV initialization had previously failed, leaving firmware in the UNINIT state, issuing SNP_COMMIT still triggered re-initialization logic that incorrectly zeroed MSR_VM_HSAVE_PA. This MSR holds the physical address of the host save area (HSAVE) used by AMD SVM for VMRUN, VMEXIT, and VMLOAD/VMSAVE instructions. A zeroed MSR causes VMRUN to raise a #GP fault, which propagates as an unhandled kernel exception, resulting in a host panic. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patches are available via upstream Linux stable: apply kernel 6.12.96 or later for the 6.12 stable series; apply kernel 6.18.39 for the 6.18 series; apply kernel 7.1.4 for the 7.1 series; or upgrade to 7.2-rc1 or later. The specific fixing commits are 74768f73854d647a6462f252dc8782ab8a835211, 7a361c74bb12f3398c388905f1d325be642cd36e, 67ed191b4c8bdf432a3f32d1eb302880b4795cd1, and 5a1364da2f04217a36e2fdfa2db4ee025b383a20 at git.kernel.org/stable/. As a compensating control where patching is not immediately possible, restrict access to /dev/sev to only trusted root-equivalent processes (e.g., via udev rules setting mode 0600 or group-binding to a tightly controlled group), which raises the bar from PR:L to effective PR:H. Disabling the ccp module entirely is possible but would break SEV-SNP guest launch functionality. Distribution-specific stable packages from major vendors should be monitored for inclusion of these commits.

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2026-64309 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy