SB20260727275 - Improper Initialization in Linux kernel crypto ccp driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Initialization (CVE-ID: CVE-2026-64307)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the /dev/sev SNP_CONFIG ioctl handler when re-initializing SNP after a failed initialization. A local user can invoke the SNP_CONFIG ioctl to cause a denial of service.

Exploitation requires access to the SEV device interface, and the host crash condition arises when normal KVM virtual machines are actively running.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/08f0e65e784c4b20e6e620dd4f68d8636073a3d2
• https://git.kernel.org/stable/c/20f548cdac94860a164e5ebba4f7e4a01051cb06
• https://git.kernel.org/stable/c/345a6e869b33687e9268044bcaeeefd7c61da675
• https://git.kernel.org/stable/c/441ea32cf2755a0dc593557056b00b7caa0651f5