Database/Firmware, BMC & network fabric
Linux crypto/ccp - SEV platform shutdown error handling: The ccp driver's SEV/SNP platform shutdown path could
Impact
The ccp driver's SEV/SNP platform shutdown path could be called without a valid error pointer, dereferencing it and panicking the host. Since this is on the SEV platform teardown path, the crash lands during operations like driver unload or SNP re-initialisation - the exact moments you are already doing maintenance on a confidential-computing host.
Who can reach it
Local, in the host's SEV platform management path; reachable by whatever drives SEV init/shutdown, i.e. host administration rather than tenants.
What to do
Fixed in the Linux kernel - KVM/x86 SEV code or the ccp/PSP driver. Take the distro kernel update (RHEL/Rocky, Ubuntu, SLES) and **reboot the host**; SEV/SNP hypervisor paths cannot be live-patched in any meaningful way, and SNP platform init/shutdown is not safe to cycle under running guests. Drain confidential-VM tenants, reboot, then re-admit. No firmware, VBIOS or AGESA step needed, which makes this one of the cheaper classes of SEV fix to roll out.
References
Related entries
- Linux kernel RDMA core address resolution (RDMA_NL_LS_OP_IP_RESOLVE netlink handler): The netlink handler forCVE-2025-71096 · Linux kernel RDMA core address resolution (RDMA_NL_LS_OP_IP_RESOLVE netlink handler)Medium
- A shared library inside Supermicro BMC firmware that parses request headers: An authenticated attacker overflowsCVE-2025-8404 · A shared library inside Supermicro BMC firmware that parses request headersMedium
- Linux kernel (drivers/infiniband/hw/irdma): If copying the queue-pair response back to userspace fails, irdma'sCVE-2026-31492 · Linux kernel (drivers/infiniband/hw/irdma)Medium
- Linux KVM/SEV - vCPU locking when synchronizing VMSAs for SNP launch finish: KVM did not lock all vCPUsCVE-2026-31591 · Linux KVM/SEV - vCPU locking when synchronizing VMSAs for SNP launch finishMedium
- Linux KVM - VMSA sync on an already-launched SEV vCPU: KVM allowed synchronising vCPU state into the VMSACVE-2026-31593 · Linux KVM - VMSA sync on an already-launched SEV vCPUMedium
- Linux bnxt_en driver (backing store type from firmware response): A second firmware-controlled-index bug in the sameCVE-2026-43034 · Linux bnxt_en driver (backing store type from firmware response)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.