CVE-2026-64309

A flaw was found in the Linux kernel's crypto: ccp module. This vulnerability arises from improper initialization of Secure Nested Paging (SNP) when handling the ioctl(SNP_COMMIT) command. A local userspace process can exploit this by sending specific commands via /dev/sev ioctls. If Secure Encrypted Virtualization (SEV) initialization fails and Kernel-based Virtual Machine (KVM) is actively running virtual machines, this flaw could lead to a Denial of Service (DoS) by causing a host crash.

SNP_COMMIT could incorrectly force SEV-SNP initialization and shutdown even though the firmware command is allowed when SNP was previously uninitialized. On an AMD SEV or SEV-SNP capable virtualization host this can disturb global firmware or SVM state while normal KVM VMs are running, and a later VMRUN may hit a general protection fault and crash the host. For the CVSS the PR:L value is used because reliable triggering requires local access to /dev/sev or an equivalent delegated virtualization management context, but not necessarily full host root in practical deployments. The issue is not network reachable by itself and must be triggered through a local ioctl path. Impact is denial of service for the host and running VMs. No UAF, OOB access, information leak, or arbitrary write primitive is visible from the provided patch context, so confidentiality and integrity are not raised.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.