The flaw originates in the Linux kernel’s SEV (Secure Encrypted Virtualization) handling when SNP (Secure Nested Paging) is omitted during certain ioctls that only need SEV firmware commands. This omission allows a userspace process to invoke a SEV ioctl, such as SEV_PDH_GEN, that triggers a firmware shutdown sequence which clears the MSR_VM_HSAVE_PA register globally. If normal virtual machines are running, the next VMRUN executes with a zeroed register, causing a general‑protection fault and crashing the host. The effect is a local denial‑of‑service that brings the entire virtualized host down. The root cause is improper error handling that discards real firmware errors and always returns INVALID_PLATFORM_STATE. The flaw is an instance of CWE-909.

All Linux kernel releases that support Intel Secure Encrypted Virtualization (SEV) and expose the /dev/sev device. This includes any kernel image with SEV support, regardless of specific version, that could execute the affected SEV firmware commands before SNP is initialized.

The vulnerability carries a CVSS score of 5.5, indicating moderate severity, and an EPSS score of < 1%; it is not listed in KEV. However, the impact—host‑wide denial of service—is high. Based on the description, it is inferred that a local attacker would need access to the /dev/sev interface, which is typically restricted to privileged users. If the flaw is triggered, the host will fault on the next VMRUN and crash. Operators should prioritize applying the kernel patch or limiting /dev/sev access to mitigate the risk.