---
id: CVE-2026-64309
title: 'crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)

  Sashiko notes:

  > if SEV initialization fails and KVM is actively running normal VMs, could a
  > userspace pro…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1c3506ea8599a3ad1b9aae5cbd573134f8d18db7 <
    74768f73854d647a6462f252dc8782ab8a835211
  - >-
    Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c <
    7a361c74bb12f3398c388905f1d325be642cd36e
  - >-
    Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c <
    67ed191b4c8bdf432a3f32d1eb302880b4795cd1
  - >-
    Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c <
    5a1364da2f04217a36e2fdfa2db4ee025b383a20
  - Linux >= 6.12.75 < 6.12.96
  - Linux 6.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:34:44.190905Z'
published: '2026-07-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:44:44.451Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64309'
references:
  - url: 'https://git.kernel.org/stable/c/74768f73854d647a6462f252dc8782ab8a835211'
  - url: 'https://git.kernel.org/stable/c/7a361c74bb12f3398c388905f1d325be642cd36e'
  - url: 'https://git.kernel.org/stable/c/67ed191b4c8bdf432a3f32d1eb302880b4795cd1'
  - url: 'https://git.kernel.org/stable/c/5a1364da2f04217a36e2fdfa2db4ee025b383a20'
tags:
  - cve.org
epss: 0.00172
epssPercentile: 0.06582
ingestedAt: '2026-11-06T16:57:43.202Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)

Sashiko notes:

> if SEV initialization fails and KVM is actively running normal VMs, could a
> userspace process trigger this code path via /dev/sev ioctls (e.g.,
> SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN
> execution for an active VM trigger a general protection fault and crash the
> host?

The SNP_COMMIT command does not require the firmware to be in any
particular state. Skip initializing it if it was previously uninitialized.

The SEV-SNP firmware specification doc 56860 does not mention SNP_COMMIT in
Table 5 as a command that is allowed in the UNINIT state, but it is in fact
allowed and a future documentation update will reflect that.

## Affected

- `Linux >= 1c3506ea8599a3ad1b9aae5cbd573134f8d18db7 < 74768f73854d647a6462f252dc8782ab8a835211`
- `Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 7a361c74bb12f3398c388905f1d325be642cd36e`
- `Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 67ed191b4c8bdf432a3f32d1eb302880b4795cd1`
- `Linux >= ceac7fb89e8da465aec3ac3c20477f912f5c3a6c < 5a1364da2f04217a36e2fdfa2db4ee025b383a20`
- `Linux >= 6.12.75 < 6.12.96`
- `Linux 6.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.