CVE-2026-64310

In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Do not initialize SNP for SEV ioctls

Sashiko notes:

if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls (e.g., SEVPDHGEN) and zero out MSRVMHSAVE_PA globally? Would the next VMRUN execution for an active VM trigger a general protection fault and crash the host?

sevmovetoinitstate() is called for ioctls requiring only SEV firmware: SEVPEKGEN, SEVPDHGEN, SEVPEKCSR, SEVPEKCERTIMPORT, and SEVPDHCERTEXPORT. After the firmware command, it does SEV_SHUTDOWN on the SEV firmware. Since these commands do not require SNP to be initialized, skip it by calling __sevplatforminitlocked() which only initializes the SEV firmware. This way SNP is not Initialized at all, and HSAVEPA is not cleared.

The previous code saved any SEV initialization firmware error to initargs.error and then threw it away and hardcoded the return value of INVALIDPLATFORM_STATE regardless of the real firmware error. This patch changes it to surface the underlying error, which is hopefully both more useful and doesn't cause any problems.

Note that it is still safe to call __sevfirmwareshutdown() directly: it calls _sevsnpshutdownlocked(), which skips SNP shutdown if SNP was not initialized.