---
id: CVE-2026-64307
title: 'crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)

  Sashiko notes:

  > if SEV initialization fails and KVM is actively running normal VMs, could a
  > userspace pro…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1c3506ea8599a3ad1b9aae5cbd573134f8d18db7 <
    345a6e869b33687e9268044bcaeeefd7c61da675
  - >-
    Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c <
    441ea32cf2755a0dc593557056b00b7caa0651f5
  - >-
    Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c <
    20f548cdac94860a164e5ebba4f7e4a01051cb06
  - >-
    Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c <
    08f0e65e784c4b20e6e620dd4f68d8636073a3d2
  - Linux >= 6.12.75 < 6.12.97
  - Linux 6.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:34:35.438688Z'
published: '2026-07-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:44:44.142Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64307'
references:
  - url: 'https://git.kernel.org/stable/c/345a6e869b33687e9268044bcaeeefd7c61da675'
  - url: 'https://git.kernel.org/stable/c/441ea32cf2755a0dc593557056b00b7caa0651f5'
  - url: 'https://git.kernel.org/stable/c/20f548cdac94860a164e5ebba4f7e4a01051cb06'
  - url: 'https://git.kernel.org/stable/c/08f0e65e784c4b20e6e620dd4f68d8636073a3d2'
tags:
  - cve.org
epss: 0.00169
epssPercentile: 0.06308
ingestedAt: '2026-11-06T16:57:43.203Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)

Sashiko notes:

> if SEV initialization fails and KVM is actively running normal VMs, could a
> userspace process trigger this code path via /dev/sev ioctls (e.g.,
> SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN
> execution for an active VM trigger a general protection fault and crash the
> host?

Refuse to re-try initialization if SNP is not already initialized for
SNP_CONFIG.

This is technically an ABI break: before if SNP initialization failed it
could be transparently retriggered by this ioctl, and if no VMs were
running, everything worked fine. Hopefully this is enough of a corner case
that nobody will notice, but someone does, there are a few options:

* do something like symbol_get() for kvm and refuse to initialize if KVM is
  loaded
* check each cpu's HSAVE_PA for non-zero data before re-initializing
* once initialization has failed, continue to refuse to initialize until
  the ccp module is unloaded

## Affected

- `Linux >= 1c3506ea8599a3ad1b9aae5cbd573134f8d18db7 < 345a6e869b33687e9268044bcaeeefd7c61da675`
- `Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 441ea32cf2755a0dc593557056b00b7caa0651f5`
- `Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 20f548cdac94860a164e5ebba4f7e4a01051cb06`
- `Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 08f0e65e784c4b20e6e620dd4f68d8636073a3d2`
- `Linux >= 6.12.75 < 6.12.97`
- `Linux 6.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.