CVE-2026-64308

A flaw was found in the Linux kernel's crypto: ccp module, which handles AMD Secure Encrypted Virtualization (SEV) and Secure Nested Paging (SNP) features. A local user, by sending specific commands through the /dev/sev interface, could exploit improper initialization handling. If SEV initialization has failed and virtual machines are active, this could lead to a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux and Red Hat In-Vehicle OS because it requires local access on an AMD virtualization host and depends on an abnormal system state to trigger a denial of service. The issue resides in the AMD Cryptographic Coprocessor driver managing confidential computing features, where local interactions with the /dev/sev device can disrupt host CPU state during a failed SEV setup while virtual machines are executing. Because exploitation is confined to host crash conditions under specific failure scenarios without exposing encrypted guest memory or enabling arbitrary code execution, the overall risk is constrained.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.