CVE-2026-64310

{"id": "CVE-2026-64310", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1c3506ea8599a3ad1b9aae5cbd573134f8d18db7", "lessThan": "5181e88da99c3d1d41e25db3472a62b8d4b42cdd", "versionType": "git"}, {"status": "affected", "version": "ceac7fb89e8da465aec3ac3c20477f912f5c3a6c", "lessThan": "9e983d0a74a6a2348e4ce61647ec8a4dfbe198ac", "versionType": "git"}, {"status": "affected", "version": "ceac7fb89e8da465aec3ac3c20477f912f5c3a6c", "lessThan": "d51207735e7c224cf591fa260c557a451a69a5cf", "versionType": "git"}, {"status": "affected", "version": "ceac7fb89e8da465aec3ac3c20477f912f5c3a6c", "lessThan": "fb1758e74b8061aacfbce7bbb7a7cc650537e167", "versionType": "git"}, {"status": "affected", "version": "6.12.75", "lessThan": "6.12.96", "versionType": "semver"}], "programFiles": ["drivers/crypto/ccp/sev-dev.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.96", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.39", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.4", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/crypto/ccp/sev-dev.c"], "defaultStatus": "affected"}]}], "published": "2026-07-25T10:17:12.147", "references": [{"url": "https://git.kernel.org/stable/c/5181e88da99c3d1d41e25db3472a62b8d4b42cdd", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9e983d0a74a6a2348e4ce61647ec8a4dfbe198ac", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d51207735e7c224cf591fa260c557a451a69a5cf", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fb1758e74b8061aacfbce7bbb7a7cc650537e167", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Do not initialize SNP for SEV ioctls\n\nSashiko notes:\n\n> if SEV initialization fails and KVM is actively running normal VMs, could a\n> userspace process trigger this code path via /dev/sev ioctls (e.g.,\n> SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN\n> execution for an active VM trigger a general protection fault and crash the\n> host?\n\nsev_move_to_init_state() is called for ioctls requiring only SEV firmware:\nSEV_PEK_GEN, SEV_PDH_GEN, SEV_PEK_CSR, SEV_PEK_CERT_IMPORT, and\nSEV_PDH_CERT_EXPORT. After the firmware command, it does SEV_SHUTDOWN on\nthe SEV firmware. Since these commands do not require SNP to be\ninitialized, skip it by calling __sev_platform_init_locked() which only\ninitializes the SEV firmware. This way SNP is not Initialized at all, and\nHSAVE_PA is not cleared.\n\nThe previous code saved any SEV initialization firmware error to\ninit_args.error and then threw it away and hardcoded the return value of\nINVALID_PLATFORM_STATE regardless of the real firmware error. This patch\nchanges it to surface the underlying error, which is hopefully both more\nuseful and doesn't cause any problems.\n\nNote that it is still safe to call __sev_firmware_shutdown() directly: it\ncalls __sev_snp_shutdown_locked(), which skips SNP shutdown if SNP was not\ninitialized."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\ncrypto: ccp - No inicializar SNP para ioctls de SEV\n\nNotas de Sashiko:\n\n> si la inicializaci\u00f3n de SEV falla y KVM est\u00e1 ejecutando activamente VMs normales, \u00bfpodr\u00eda un\n> proceso de espacio de usuario activar esta ruta de c\u00f3digo a trav\u00e9s de ioctls de /dev/sev (p. ej.,\n> SEV_PDH_GEN) y poner a cero MSR_VM_HSAVE_PA globalmente? \u00bfLa siguiente ejecuci\u00f3n de VMRUN\n> para una VM activa activar\u00eda una falla de protecci\u00f3n general y colapsar\u00eda el\n> host?\n\nsev_move_to_init_state() se llama para ioctls que requieren solo firmware de SEV:\nSEV_PEK_GEN, SEV_PDH_GEN, SEV_PEK_CSR, SEV_PEK_CERT_IMPORT y\nSEV_PDH_CERT_EXPORT. Despu\u00e9s del comando de firmware, realiza SEV_SHUTDOWN en\nel firmware de SEV. Dado que estos comandos no requieren que SNP sea\ninicializado, se omite llamando a __sev_platform_init_locked() que solo\ninicializa el firmware de SEV. De esta manera, SNP no se inicializa en absoluto, y\nHSAVE_PA no se borra.\n\nEl c\u00f3digo anterior guardaba cualquier error de firmware de inicializaci\u00f3n de SEV en\ninit_args.error y luego lo descartaba y codificaba el valor de retorno de\nINVALID_PLATFORM_STATE independientemente del error real del firmware. Este parche\nlo cambia para mostrar el error subyacente, lo que, con suerte, es m\u00e1s\n\u00fatil y no causa ning\u00fan problema.\n\nTenga en cuenta que sigue siendo seguro llamar a __sev_firmware_shutdown() directamente:\nllama a __sev_snp_shutdown_locked(), que omite el apagado de SNP si SNP no fue\ninicializado."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C1E3642-D5B1-428A-9CC8-2B6059DEA06A", "versionEndExcluding": "6.12.96", "versionStartIncluding": "6.12.75"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFBD7467-7FB0-4538-9CC0-98199E9EC402", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}