SB20260727276 - Improper control of a resource through its lifetime in Linux kernel crypto ccp driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64308)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the sev ioctl handler for SNP_VLEK_LOAD when handling ioctl requests to /dev/sev without prior SNP initialization. A local user can issue a crafted ioctl request to trigger host crashes.

Exploitation requires access to the SEV device interface, and the issue can affect hosts running active virtual machines.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/61cf5eef20657bff9ca235fe938a99ce5ff65c06
• https://git.kernel.org/stable/c/8836801847b9479ac046cb18a24981e1b0b05e9d
• https://git.kernel.org/stable/c/92567ed9306d5a3d1b007eb4faeff30cc3ffc3e4
• https://git.kernel.org/stable/c/f91e9dbb5845d1e5abf1028e6df57dcf61583e1b