Database/Firmware, BMC & network fabric
Linux KVM/SVM - SEV/SEV-ES intra-host migration during vCPU creation: MULTI-TENANT ISOLATION: KVM permitted SEV/SEV-ES
Impact
MULTI-TENANT ISOLATION: KVM permitted SEV/SEV-ES intra-host migration while vCPU creation was still in flight, producing a race on confidential-VM state. Migration racing against vCPU setup means encrypted vCPU state can be moved or referenced while half-built - a route to host memory corruption driven from the VM lifecycle path.
Who can reach it
Through the KVM ioctl interface used for migration, reachable by the VMM process - so a compromised orchestrator or VMM.
What to do
Fixed in the Linux kernel. Take the distro kernel update (RHEL/Rocky, Ubuntu, SLES) and reboot the host - no firmware, VBIOS or AGESA step. On a GPU fleet this is a cordon, drain and rolling reboot; plan it as normal kernel maintenance. Interim control: disable intra-host migration for SEV guests in your VMM configuration.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.