The Linux kernel KVM implementation for Intel Secure Encrypted Virtualization (SEV) lacks the required state transfer for Secure Nested Paging (SNP) when a virtual machine is migrated or mirrored within the same host. As a result, the kernel rejects any attempt to perform these operations, preventing migration or mirroring from succeeding. This failure limits the availability of VM management features and can lead to a denial of service for administrators relying on these operations. The vulnerability does not provide a path to arbitrary code execution.

All Linux kernels that include KVM SEV support are affected, regardless of distribution vendor. Any host running a Linux kernel with SEV enabled that attempts to migrate or mirror SEV‑SNP virtual machines before the commit that implements proper SNP state transfer is vulnerable.

The flaw carries a CVSS score of 8.8, indicating high severity, while the EPSS score of < 1% denotes a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. The kernel’s current check rejects migration attempts, which provides a safety net; however, based on the description, it is inferred that a privileged local user or compromised migration tool might be able to bypass or abuse the logic, potentially leading to a denial of service. The likely attack vector is a privileged process or user initiating migration or mirroring operations on SEV‑SNP virtual machines, which would trigger the failure if the check were circumvented.