USN-9003-1: Linux kernel (NVIDIA) vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory...

igvm

igvm This project is the home of the Independent Guest Virtual Machine IGVM file format. The format specification can be found in the igvmdefs crate, with a Rust implementation of the binary format in the igvm crate. The IGVM file format is designed to encapsulate all information required to laun...

CVE-2026-99258

A flaw was found in the Linux kernel's Hyper-V subsystem. When operating in an AMD Secure Encrypted Virtualization-Secure Nested Paging SEV-SNP confidential virtual machine without a paravisor, the kernel fails to allocate an output buffer for hypervisor communication. Consequently, querying...

CVE-2026-53360-POC

CVE-2026-53360: KVM SEV-SNP PSC heap out-of-bounds Proof of concept for a heap out-of-bounds read and write in KVM's SEV-SNP Page State Change PSC handling. A malicious SEV-SNP guest makes the host kernel walk a PSC entry array off the end of its slab allocation. That leaks the layout of...

CVE-2026-99258

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...

UBUNTU-CVE-2026-99258

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...

CVE-2026-99258 x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...

CVE-2026-99258

The Linux kernel contains a vulnerability in the x86/hyperv architecture specifically regarding the hv_apicid_to_vp_index() function. The issue arises because the function uses per-cpu hypercall input and output pages; however, in SEV-SNP CoCo VMs without a paravisor, the output page is not alloc...

EUVD-2026-115769

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...

PT-2026-136094

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hv apicid to vp index hv apicid to vp index currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP...

CVE-2026-99177

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem. This vulnerability may lead to a Denial of Service DoS due to improper locking when marking guest memory pages as modified during AMD Secure Encrypted Virtualization SEV operations. A local user with permissions to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

CVE-2025-29946

Insufficient or Incomplete Data Removal in Hardware Component in SEV firmware doesn't fully flush IOMMU. This can potentially lead to a loss of confidentiality and integrity in guest memory...

CVE-2025-0029

Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writes, potentially resulting in a loss of SEV-SNP guest memory integrity...

CVE-2025-29948

Improper access control in AMD Secure Encrypted Virtualization SEV firmware could allow a malicious hypervisor to bypass RMP protections, potentially resulting in a loss of SEV-SNP guest memory integrity...

CVE-2025-0031

A use after free in the SEV firmware could allow a malicous hypervisor to activate a migrated guest with the SINGLESOCKET policy on a different socket than the migration agent potentially resulting in loss of integrity...

CVE-2025-29939

Improper access control in secure encrypted virtualization SEV could allow a privileged attacker to write to the reverse map page RMP during secure nested paging SNP initialization, potentially resulting in a loss of guest memory confidentiality and integrity...

CVE-2025-29952

Improper Initialization within the AMD Secure Encrypted Virtualization SEV firmware can allow an admin privileged attacker to corrupt RMP covered memory, potentially resulting in loss of guest memory integrity...

Linux Distros Unpatched Vulnerability : CVE-2025-0029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writes, potentially...

cve-2023-31355-poc

SEV Firmware Vulnerability This repo contains an exploit for a vulnerability in the SEV firmware. The exploit allows decrypting arbitrary memory of an SEV-SNP guest after it's been decommissioned. Tested on version 1.55.16 latest as of time of writing. Root Cause snpreclaimbuffer unconditionally...