Improper Initialization in Linux kernel - CVE-2026-64307
Published: July 27, 2026
Vulnerability identifier: #VU139677
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64307
CWE-ID: CWE-665
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state management in the /dev/sev SNP_CONFIG ioctl handler when re-initializing SNP after a failed initialization. A local user can invoke the SNP_CONFIG ioctl to cause a denial of service.
Exploitation requires access to the SEV device interface, and the host crash condition arises when normal KVM virtual machines are actively running.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-64307
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.100-1
linux (Debian package) - update to 6.12.100-1