{"id":"CVE-2026-64308","title":"crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)\n\nSashiko notes:\n\n> if SEV initialization fails and KVM is actively running normal VMs, could a\n> userspace …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1c3506ea8599a3ad1b9aae5cbd573134f8d18db7 < 61cf5eef20657bff9ca235fe938a99ce5ff65c06","Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 92567ed9306d5a3d1b007eb4faeff30cc3ffc3e4","Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 8836801847b9479ac046cb18a24981e1b0b05e9d","Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < f91e9dbb5845d1e5abf1028e6df57dcf61583e1b","Linux >= 6.12.75 < 6.12.96","Linux 6.16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:34:39.644370Z"},"published":"2026-07-25","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:44:44.294Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64308","references":[{"url":"https://git.kernel.org/stable/c/61cf5eef20657bff9ca235fe938a99ce5ff65c06"},{"url":"https://git.kernel.org/stable/c/92567ed9306d5a3d1b007eb4faeff30cc3ffc3e4"},{"url":"https://git.kernel.org/stable/c/8836801847b9479ac046cb18a24981e1b0b05e9d"},{"url":"https://git.kernel.org/stable/c/f91e9dbb5845d1e5abf1028e6df57dcf61583e1b"}],"tags":["cve.org"],"epss":0.00172,"epssPercentile":0.06582,"ingestedAt":"2026-11-06T16:57:43.202Z","slug":"CVE-2026-64308","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)\n\nSashiko notes:\n\n> if SEV initialization fails and KVM is actively running normal VMs, could a\n> userspace process trigger this code path via /dev/sev ioctls (e.g.,\n> SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN\n> execution for an active VM trigger a general protection fault and crash the\n> host?\n\nThe SEV firmware docs for SNP_VLEK_LOAD note:\n\n> On SNP_SHUTDOWN, the VLEK is deleted.\n\nThat is, the initialization/shutdown wrapper here is pointless, because the\nfirmware immediately throws away the key anyway. Instead, refuse to do\nanything if SNP has not been previously initialized.\n\nThis is an ABI break: before, this was a no-op and almost certainly a\nmistake by userspace, and now it returns -ENODEV. ABI compatibility could be\nmaintained here by simply returning 0 in the check instead.\n\n## Affected\n\n- `Linux >= 1c3506ea8599a3ad1b9aae5cbd573134f8d18db7 < 61cf5eef20657bff9ca235fe938a99ce5ff65c06`\n- `Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 92567ed9306d5a3d1b007eb4faeff30cc3ffc3e4`\n- `Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 8836801847b9479ac046cb18a24981e1b0b05e9d`\n- `Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < f91e9dbb5845d1e5abf1028e6df57dcf61583e1b`\n- `Linux >= 6.12.75 < 6.12.96`\n- `Linux 6.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}