{"id":"CVE-2026-64309","title":"crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)\n\nSashiko notes:\n\n> if SEV initialization fails and KVM is actively running normal VMs, could a\n> userspace pro…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1c3506ea8599a3ad1b9aae5cbd573134f8d18db7 < 74768f73854d647a6462f252dc8782ab8a835211","Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 7a361c74bb12f3398c388905f1d325be642cd36e","Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 67ed191b4c8bdf432a3f32d1eb302880b4795cd1","Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 5a1364da2f04217a36e2fdfa2db4ee025b383a20","Linux >= 6.12.75 < 6.12.96","Linux 6.16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:34:44.190905Z"},"published":"2026-07-25","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:44:44.451Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64309","references":[{"url":"https://git.kernel.org/stable/c/74768f73854d647a6462f252dc8782ab8a835211"},{"url":"https://git.kernel.org/stable/c/7a361c74bb12f3398c388905f1d325be642cd36e"},{"url":"https://git.kernel.org/stable/c/67ed191b4c8bdf432a3f32d1eb302880b4795cd1"},{"url":"https://git.kernel.org/stable/c/5a1364da2f04217a36e2fdfa2db4ee025b383a20"}],"tags":["cve.org"],"epss":0.00172,"epssPercentile":0.06582,"ingestedAt":"2026-11-06T16:57:43.202Z","slug":"CVE-2026-64309","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)\n\nSashiko notes:\n\n> if SEV initialization fails and KVM is actively running normal VMs, could a\n> userspace process trigger this code path via /dev/sev ioctls (e.g.,\n> SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN\n> execution for an active VM trigger a general protection fault and crash the\n> host?\n\nThe SNP_COMMIT command does not require the firmware to be in any\nparticular state. Skip initializing it if it was previously uninitialized.\n\nThe SEV-SNP firmware specification doc 56860 does not mention SNP_COMMIT in\nTable 5 as a command that is allowed in the UNINIT state, but it is in fact\nallowed and a future documentation update will reflect that.\n\n## Affected\n\n- `Linux >= 1c3506ea8599a3ad1b9aae5cbd573134f8d18db7 < 74768f73854d647a6462f252dc8782ab8a835211`\n- `Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 7a361c74bb12f3398c388905f1d325be642cd36e`\n- `Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 67ed191b4c8bdf432a3f32d1eb302880b4795cd1`\n- `Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 5a1364da2f04217a36e2fdfa2db4ee025b383a20`\n- `Linux >= 6.12.75 < 6.12.96`\n- `Linux 6.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}