Skip to main content

Linux Kernel EUVDEUVD-2026-49020

| CVE-2026-64308 MEDIUM
2026-07-25 Linux GHSA-jg4q-h984-9pjc
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local /dev/sev access required (AV:L, PR:L); no confidentiality or integrity impact; host crash yields A:H only.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 04, 2026 - 13:24 vuln.today
CVSS changed
Sep 04, 2026 - 13:22 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:49 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:49 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)

Sashiko notes:

> if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash the > host?

The SEV firmware docs for SNP_VLEK_LOAD note:

> On SNP_SHUTDOWN, the VLEK is deleted.

That is, the initialization/shutdown wrapper here is pointless, because the firmware immediately throws away the key anyway. Instead, refuse to do anything if SNP has not been previously initialized.

This is an ABI break: before, this was a no-op and almost certainly a mistake by userspace, and now it returns -ENODEV. ABI compatibility could be maintained here by simply returning 0 in the check instead.

AnalysisAI

Uncontrolled SNP initialization in the Linux kernel's CCP/SEV driver allows a local low-privileged user with /dev/sev access to crash the host kernel on AMD SEV/SNP-capable systems running KVM. Sending a SNP_VLEK_LOAD ioctl when SNP has not been initialized triggers an unnecessary initialization/shutdown wrapper that zeros MSR_VM_HSAVE_PA globally; the subsequent VMRUN instruction for any active KVM guest then triggers a General Protection Fault, bringing down the host and terminating all co-hosted VMs. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects the specialized attack environment required.

Technical ContextAI

The vulnerability is in the AMD Cryptographic Co-Processor (CCP) driver's SEV/SNP subsystem (drivers/crypto/ccp) within the Linux kernel. AMD Secure Nested Paging (SNP) supports a VM Launch Encryption Key (VLEK) loaded via the SNP_VLEK_LOAD ioctl on /dev/sev. The handler was incorrectly wrapping this operation with SNP initialization and shutdown sequences. AMD firmware documentation confirms 'On SNP_SHUTDOWN, the VLEK is deleted,' making the wrapper both pointless (key immediately discarded) and dangerous: the initialization path zeros MSR_VM_HSAVE_PA - the Model-Specific Register holding the Host Save Area pointer required for VMRUN - across all CPUs. If called when SNP is uninitialized, any subsequent VMRUN instruction from an active KVM guest raises a General Protection Fault, crashing the host. CWE classification is not assigned, but the root cause is improper sequencing of privileged hardware initialization (closest to CWE-362 or CWE-665). CPE: cpe:2.3:a:linux:linux.

RemediationAI

Apply upstream stable kernel patches available at git.kernel.org: commit 61cf5eef20657bff9ca235fe938a99ce5ff65c06 (https://git.kernel.org/stable/c/61cf5eef20657bff9ca235fe938a99ce5ff65c06), 92567ed9306d5a3d1b007eb4faeff30cc3ffc3e4, 8836801847b9479ac046cb18a24981e1b0b05e9d, and f91e9dbb5845d1e5abf1028e6df57dcf61583e1b. Vendor-released patched versions confirmed by EUVD include Linux 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1. Note the ABI change: post-patch, SNP_VLEK_LOAD returns -ENODEV instead of 0 when SNP is not initialized; userspace SEV management tools (libvirt, sev-tool, QEMU SEV helpers) should be audited for this return code. As a compensating control on unpatched systems, restrict /dev/sev permissions to root-only via udev rules - this eliminates PR:L exploitation but may break legitimate SEV VM management workflows that rely on non-root access. Blacklisting the ccp module entirely eliminates the attack surface but also disables AMD hardware crypto acceleration.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

EUVD-2026-49020 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy