The Linux kernel’s KVM SEV module fails to allocate temporary buffers for encryption and decryption on SNP‑enabled hosts on full 4‑KiB pages. When a sub‑page buffer is used, the page becomes shared between KVM and other kernel code. The SNP specification requires firmware to own the page during SEV commands, making the shared portion inaccessible to software. Consequently a kernel write generates an RMP page‑fault that triggers a panic. The result is a denial of service: the host kernel crashes and must reboot, affecting any SEV or SEV‑ES guests running on the system.

All Linux kernel builds running on CPUs that implement Secure Nested Paging and that enable KVM SEV or SEV‑ES guest support are affected. This includes any SNP‑enabled host, regardless of distribution, as long as the kernel has not been updated to include the full‑page allocation fix. The defect does not depend on specific kernel versions but on the presence of the unfixed allocation logic.

The vulnerability does not provide privilege escalation, but it allows anyone with the ability to create or interact with SEV guests to repeatedly trigger a kernel panic. Attackers would need kernel or privileged user access to instantiate or manipulate SEV guests, which is typically restricted to administrators. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, indicating no known public exploits. Nevertheless, the severity of a host crash warrants an immediate patch or mitigations. Because the flaw requires privileged operations, the threat window is limited to systems where such privileges are available.