CVE-2026-72286

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) with Secure Encrypted Virtualization (SEV) and Secure Nested Paging (SNP) virtual machines. The intra-host migration and mirroring feature is not fully implemented for SEV-SNP VMs. This incomplete implementation means that critical SNP-specific security state is not properly transferred or initialized during these operations. Consequently, allowing such operations could lead to a bypass of the intended security protections for the virtual machine, potentially compromising its integrity or confidentiality.

KVM allowed encrypted context move or mirror operations from a SEV-SNP source VM even though SNP specific state was not transferred or initialized on the destination. The missing state includes guest_req_mutex, guest_req_buf, guest_resp_buf, and VMSA feature information, which can leave the destination VM in an inconsistent encrypted context. For the CVSS the PR:L is used for the paranoid score because a local VMM process or user with access to KVM VM file descriptors can trigger these ioctls without being full host root in many deployments. The issue is not directly network reachable and requires local control plane access to KVM. Impact is at least guest or KVM availability degradation, and in the worst still defensible interpretation may affect confidentiality or integrity boundaries of SEV-SNP state due to inconsistent ASID and VM type handling.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.