CVE-2026-64309 - Vulnerability Details

- crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)

Sashiko notes:

> if SEV initialization fails and KVM is actively running normal VMs, could a
> userspace process trigger this code path via /dev/sev ioctls (e.g.,
> SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN
> execution for an active VM trigger a general protection fault and crash the
> host?

The SNP_COMMIT command does not require the firmware to be in any
particular state. Skip initializing it if it was previously uninitialized.

The SEV-SNP firmware specification doc 56860 does not mention SNP_COMMIT in
Table 5 as a command that is allowed in the UNINIT state, but it is in fact
allowed and a future documentation update will reflect that.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s SNP_COMMIT ioctl does not initialize the SNP state when first invoked, allowing a SEV‑PDH‑GEN ioctl to globally zero the MSR_VM_HSAVE_PA register; on the next VM run this causes a general protection fault that can crash the host, denying service to all virtual machines. The flaw corresponds to CWE‑908 (Improper Validation of Material Provided by the User).

Affected Systems

All Linux kernel installations that have not incorporated the patch introducing the SNP_COMMIT initialization guard are affected. The vulnerability is triggered via /dev/sev ioctl commands, which are typically reserved for privileged processes.

Risk and Exploitability

The CVSS score is 5.5, and the EPSS score is less than 1%. The vulnerability is not listed in the CISA KEV catalog. The description indicates the attack may involve interaction with /dev/sev, although detailed exploitation conditions are not fully specified. No evidence of widespread exploitation is provided.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1c3506ea8599a3ad1b9aae5cbd573134f8d18db7`	affected	< 74768f73854d647a6462f252dc8782ab8a835211
`ceac7fb89e8da465aec3ac3c20477f912f5c3a6c`	affected	< 7a361c74bb12f3398c388905f1d325be642cd36e
`ceac7fb89e8da465aec3ac3c20477f912f5c3a6c`	affected	< 67ed191b4c8bdf432a3f32d1eb302880b4795cd1
`ceac7fb89e8da465aec3ac3c20477f912f5c3a6c`	affected	< 5a1364da2f04217a36e2fdfa2db4ee025b383a20
`6.12.75`	affected	< 6.12.96

Linux

affected

Version	Status	Constraints
`6.16`	affected	—
`0`	unaffected	< 6.16
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1c3506ea8599a3ad1b9aae5cbd573134f8d18db7,74768f73854d647a6462f252dc8782ab8a835211)`	affected	code_commit	—
`[ceac7fb89e8da465aec3ac3c20477f912f5c3a6c,7a361c74bb12f3398c388905f1d325be642cd36e)`	affected	code_commit	—
`[ceac7fb89e8da465aec3ac3c20477f912f5c3a6c,67ed191b4c8bdf432a3f32d1eb302880b4795cd1)`	affected	code_commit	—
`[ceac7fb89e8da465aec3ac3c20477f912f5c3a6c,5a1364da2f04217a36e2fdfa2db4ee025b383a20)`	affected	code_commit	—
`[6.12.75,6.12.96)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.16`	affected	semver	—
`[0,6.16)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest kernel version that contains the ccp patch, which adds an initialization guard to SNP_COMMIT and fixes the CWE‑908 vulnerability.
Restrict /dev/sev access to root or a dedicated privileged group via udev rules to prevent untrusted processes from invoking SEV ioctl commands, thus mitigating the CWE‑908 validation issue.
Monitor system logs for kernel panics or general protection faults after SEV ioctl activity and promptly install updated security patches to reduce risk.

Generated by OpenCVE AI on August 3, 2026 at 19:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00215.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/5a1364da2f04217a36e2fdfa2db4ee025b383a20
https://git.kernel.org/stable/c/67ed191b4c8bdf432a3f32d1eb302880b4795cd1
https://git.kernel.org/stable/c/74768f73854d647a6462f252dc8782ab8a835211
https://git.kernel.org/stable/c/7a361c74bb12f3398c388905f1d325be642cd36e
https://lore.kernel.org/linux-cve-announce/2026072508-CVE-2026-64309-77b5@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64309
https://www.cve.org/CVERecord?id=CVE-2026-64309

History

Sun, 02 Aug 2026 13:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665

Tue, 28 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-908
References		https://lore.kernel.org/linux-cve-announce/2026072508-CVE-2026-64309-77b5@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64309 https://www.cve.org/CVERecord?id=CVE-2026-64309
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 26 Jul 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash the > host? The SNP_COMMIT command does not require the firmware to be in any particular state. Skip initializing it if it was previously uninitialized. The SEV-SNP firmware specification doc 56860 does not mention SNP_COMMIT in Table 5 as a command that is allowed in the UNINIT state, but it is in fact allowed and a future documentation update will reflect that.
Title		crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5a1364da2f04217a36e2fdfa2db4ee025b383a20 https://git.kernel.org/stable/c/67ed191b4c8bdf432a3f32d1eb302880b4795cd1 https://git.kernel.org/stable/c/74768f73854d647a6462f252dc8782ab8a835211 https://git.kernel.org/stable/c/7a361c74bb12f3398c388905f1d325be642cd36e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:49:42.035Z

Updated: 2026-07-25T08:49:42.035Z

Reserved: 2026-07-19T15:36:31.779Z

Link: CVE-2026-64309

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:12.030

Modified: 2026-08-11T15:00:57.447

Link: CVE-2026-64309

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64309 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T19:30:04Z

Weaknesses

CWE-908
Use of Uninitialized Resource

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object