Linux Kernel EUVD-2026-48997

The vulnerability resides in the KVM (Kernel-based Virtual Machine) subsystem's handling of AMD SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) guest initialization via the guest_memfd interface. When populating CPUID data for an SNP guest, KVM previously acquired only a read pin - not a writable pin - on the userspace-supplied source page. AMD's Secure Processor (trusted firmware) validates CPUID entries and can reject userspace-supplied values, upon which KVM writes back the authoritative corrected values directly to the source page via a kernel mapping. Using a read-only pin in this path allows KVM to overwrite read-only memory, producing a kernel oops or panic on the host. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* confirms the scope is the upstream Linux kernel. No CWE is assigned by NVD, but the root cause is closest to improper memory access rights enforcement - the kernel fails to verify write permissions on a page it subsequently writes to. The EUVD tags this as 'Information Disclosure,' which directly conflicts with the CVSS vector (C:N) and the description; the actual impact is host availability loss, not data exposure - this tag appears to be a classification error.