Linux KVM/SEV: unlocked sev_guest() check lets a local user crash the host kernel

Impact

On an AMD SEV host, sev_mem_enc_register_region() checked sev_guest() before taking kvm->lock, so a failed KVM_SEV_INIT/KVM_SEV_INIT2 could leave the VM adding memory regions to a not-yet-initialized sev->regions_list. The syzkaller reproducer in the record produces a general protection fault (NULL-pointer dereference) in kernel context, i.e. a host crash. On a GPU node that runs confidential VMs for tenants, any tenant or local process holding /dev/kvm can take the whole hypervisor down, killing every other VM and every in-flight training or inference job on that host. No information disclosure is claimed in the record - the demonstrated effect is availability.

Who can reach it

Local, authenticated: a user or process with access to /dev/kvm on an SEV-capable host (any tenant allowed to create VMs). Not reachable remotely and not reachable on hosts that do not expose KVM.

What to do

Apply the stable kernel update that takes kvm->lock across the whole of sev_mem_enc_register_region() (five stable commits are linked in the record; no fixed release number is given there). A kernel update means draining the node and rebooting it - on a GPU host that is a full evacuation of running jobs. Until then, restricting /dev/kvm to trusted management components removes the attack path.

References

Related entries

• Linux kernel: AMD Zen1 divider leaks partial results across SMT threads until the FPDSS bit is setCVE-2026-31628 · Linux kernel x86/CPU (AMD Zen1 FPDSS divider chicken bit)Medium
• Linux kernel AF_ALG: receive-side scatterlist extraction ignored the receive buffer budgetCVE-2026-31677 · Linux kernel crypto AF_ALG (af_alg_get_rsgl receive buffer accounting)Medium
• Linux kernel BPF: sleepable programs could attach to kprobe_multi and sleep in atomic contextCVE-2026-43010 · Linux kernel BPF (bpf_kprobe_multi_link_attach sleepable program check)Medium
• Linux kernel AF_ALG: missing SGL end-marker clearing lets a local user panic the host via sg_next() NULL dereferenceCVE-2026-43043 · Linux kernel AF_ALG crypto socket interface (af_alg_alloc_tsgl scatterlist chaining)Medium
• Linux kernel algif_aead: minimum receive-buffer check ignores the authentication tag during decryptionCVE-2026-43077 · Linux kernel algif_aead (AF_ALG AEAD receive buffer size check)Medium
• Linux kernel x86 shadow stacks: shstk_pop_sigframe ignores mmap_read_lock_killable() failure on signal returnCVE-2026-43109 · Linux kernel x86 shadow stacks (shstk_pop_sigframe mmap lock error handling)Medium