Linux x86/mm - pfn_to_kaddr() 64-bit input handling (SNP support code): On 64-bit platforms the pfn_to_kaddr() macro

Impact

On 64-bit platforms the pfn_to_kaddr() macro dropped high address bits when handed a narrower type, producing wrong kernel addresses in the SEV-SNP support paths that use it. Wrong addresses in code that manages confidential-guest page state means operating on memory that is not the memory intended - a correctness failure right underneath the mechanism enforcing guest isolation.

Who can reach it

Local, in the host kernel's SNP page-management paths.

What to do

Fixed in the Linux kernel - KVM/x86 SEV code or the ccp/PSP driver. Take the distro kernel update (RHEL/Rocky, Ubuntu, SLES) and **reboot the host**; SEV/SNP hypervisor paths cannot be live-patched in any meaningful way, and SNP platform init/shutdown is not safe to cycle under running guests. Drain confidential-VM tenants, reboot, then re-admit. No firmware, VBIOS or AGESA step needed, which makes this one of the cheaper classes of SEV fix to roll out.

References