Linux ccp/SEV: zero-length cert chain in PDH export hits a BUG_ON on CONFIG_DEBUG_VIRTUAL kernels

Impact

The SEV PDH export ioctl on /dev/sev did not treat a zero-length userspace cert-chain buffer as a length query, so it took the physical address of ZERO_SIZE_PTR. On kernels built with CONFIG_DEBUG_VIRTUAL=y that hits a BUG_ON in __phys_addr and takes the host down - a syzkaller-reproduced local panic from a single ioctl. The commit message states the bug is benign on ordinary production kernels, where the address computation is just arithmetic and the PSP errors out before writing, so the exposure is limited to debug-configured builds. On a confidential-computing GPU host a panic here kills every guest on the node, and SEV hosts are exactly the ones you cannot cheaply drain.

Who can reach it

Local, from any process that can open /dev/sev and issue the PDH export ioctl. On a correctly permissioned host that is the VMM or a management daemon rather than a tenant; authentication is whatever guards that device node. Only kernels built with CONFIG_DEBUG_VIRTUAL=y are known to panic.

What to do

Fixed in the mainline Linux kernel ccp/PSP driver; take the distro kernel update and reboot the host. SEV/PSP paths are not meaningfully live-patchable, so this is a drain-and-reboot for confidential-VM nodes. Interim mitigation on unpatched hosts: confirm CONFIG_DEBUG_VIRTUAL is off in your production kernel config and audit which accounts hold /dev/sev. The record names no fixed release version, only the stable commits.

References

Related entries

• Linux BPF LSM: attaching to xfrm_decode_session turns packet classification into a kernel panicCVE-2026-80669 · Linux kernel BPF LSM (xfrm_decode_session hook attachment)Unscored
• Linux kernel migrate_device: pte_pfn/pte_dirty called on non-present PTEs during device migrationCVE-2026-80686 · Linux kernel mm/migrate_device (migrate_vma_collect_pmd non-present PTE handling)Unscored
• Linux iommufd: vDEVICE alloc error path leaks the igroup mutex and deadlocks later vDEVICE operationsCVE-2026-80687 · Linux kernel iommufd/viommu (vDEVICE alloc ioctl igroup lock)Unscored
• Linux kernel idxd: double free of wq, engine and group structs on setup error and cleanup pathsCVE-2026-80698 · Linux kernel dmaengine idxd (Intel DSA/IAA wq, engine and group device setup)Unscored
• Linux kernel KVM arm64 vGIC: double-deactivate of nested IRQs trips an AmpereOne erratumCVE-2026-80699 · Linux kernel KVM/arm64 vGIC (nested-context IRQ deactivation)Unscored
• Linux kernel MGLRU: stale batch updates after memcg reparenting cause premature OOM killsCVE-2026-80719 · Linux kernel mm MGLRU (per-generation batch accounting across memcg reparenting)Unscored