Database/Kernel, userspace & hypervisor
Linux KVM x86 - hypercall completion for protected guests: KVM used the wrong helper to decide whether a hypercall
Impact
KVM used the wrong helper to decide whether a hypercall was 64-bit when completing it, which misbehaves for guests with protected state such as SEV-ES and SEV-SNP where the host cannot see guest registers. The result is host-side state confusion driven by a confidential guest - a crash or incorrect emulation on the hypervisor path that every other guest on the node shares.
Who can reach it
From inside a protected (SEV-ES/SNP) guest issuing hypercalls.
What to do
Fixed in the Linux kernel - KVM/x86 SEV code or the ccp/PSP driver. Take the distro kernel update (RHEL/Rocky, Ubuntu, SLES) and **reboot the host**; SEV/SNP hypervisor paths cannot be live-patched in any meaningful way, and SNP platform init/shutdown is not safe to cycle under running guests. Drain confidential-VM tenants, reboot, then re-admit. No firmware, VBIOS or AGESA step needed, which makes this one of the cheaper classes of SEV fix to roll out.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.