Improper control of a resource through its lifetime in Linux kernel - CVE-2026-64308
Published: July 27, 2026
Vulnerability identifier: #VU139678
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64308
CWE-ID: CWE-664
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state management in the sev ioctl handler for SNP_VLEK_LOAD when handling ioctl requests to /dev/sev without prior SNP initialization. A local user can issue a crafted ioctl request to trigger host crashes.
Exploitation requires access to the SEV device interface, and the issue can affect hosts running active virtual machines.
Affected software
Linux kernel
How to mitigate CVE-2026-64308
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3