In the Linux kernel, the CCP crypto module fails to initialize the Intel SEV SNP feature during the ioctl(SNP_CONFIG) call, which can still be invoked by userspace. The call can zero the global MSR_VM_HSAVE_PA register; on the next VM run the host attempts to use the cleared register and triggers a general protection fault, causing a kernel panic. The flaw represents a denial‑of‑service weakness (CWE‑455).

Any system running a Linux kernel that includes the CCP module and a loaded KVM subsystem may be affected. Specific version information is not available in the entry, so all kernel releases containing the CCP SNP code prior to the fix should be considered vulnerable.

The CVSS score of 5.5 indicates a moderate severity impact, providing an estimate of the potential damage. The EPSS score is listed as < 1%, suggesting a very low probability of exploitation in the wild, and this vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Exploiting the flaw would require a process that can access the /dev/sev device and invoke the ioctl(SNP_CONFIG) operation; this capability typically demands elevated or privileged access, which is therefore inferred from the nature of the device. Once the ioctl is called after a failed SEV initialization, the global MSR_VM_HSAVE_PA register can be cleared, and the subsequent VMRUN by a running virtual machine will trigger a general protection fault, causing the host to kernel panic. The result is a denial‑of‑service condition that affects all VMs managed by KVM on the affected host.