A flaw in the Linux kernel’s crypto:ccp subsystem prevents the SNP (Secure Nested Paging) feature from being properly initialized when the ioctl(SNP_VLEK_LOAD) call is used. The code would zero out the MSR_VM_HSAVE_PA register globally if SEV initialization fails while normal virtual machines are running, and then the next VMRUN attempt would trigger a general protection fault. This fault causes the host hypervisor to crash, resulting in a denial of service that brings down all virtual machines on the host. The weakness is an improper error handling path that effectively ignores a missing SNP initialization and then performs an operation that assumes a valid state, an error covered by CWE-909.

All Linux kernel versions that include the generic crypto:ccp code path are impacted. The vulnerability exists in the core kernel and is therefore present in any distribution that has not incorporated the upstream patch. Since the code path is part of the syscall interface exposed via /dev/sev, the flaw affects any system that runs KVM with SEV support and does not have protective limits on access to the device.

The EPSS score is below 1% and the vulnerability does not appear in the CISA KEV catalog, indicating a low current exploitation probability. Nonetheless, the impact is severe enough to crash the host, so the CVSS score of 5.5 signals a moderate severity. An attacker would most likely need local or privileged userspace access to issue /dev/sev ioctl calls that trigger the faulty code path, such as SEV_PDH_GEN. Once triggered, the fault is almost guaranteed to occur on the next VMRUN, making the attack path reliable from the attacker’s perspective.