CVE-2026-72286 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs
The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. The proper migration requires additional SNP-specific state such as guest_req_mutex, guest_req_buf, and guest_resp_buf to be transferred or initialized on the destination.
The SNP VM mirroring requires vmsa features to be copied as well otherwise ASID would be bound to SNP range while VM is detected as a SEV VM.
Reject SNP source VMs in migration/mirroring until proper SNP state transfer is implemented.
[sean: let lines poke past 80 chars, tag for stable]
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation specifically affecting SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) virtual machines. This security flaw represents a critical gap in the hypervisor's migration capabilities where the intra-host migration and mirroring features remain inadequately implemented for SNP-protected virtual environments. The issue stems from incomplete state management during VM movement operations, creating potential security risks that could compromise the integrity of encrypted virtual machine workloads.
The technical root cause involves insufficient handling of SNP-specific state variables during migration operations. When attempting to migrate or mirror SNP VMs within the same host system, the kernel fails to properly transfer critical components including guest_req_mutex, guest_req_buf, and guest_resp_buf to the destination host. These elements represent essential synchronization and communication buffers required for proper SNP operation. Additionally, the vmsa (Virtual Machine Save Area) features necessary for maintaining proper ASID (Address Space Identifier) binding are not correctly copied during the mirroring process, leading to inconsistencies where the ASID becomes bound to SNP ranges while the VM is still identified as a SEV VM rather than an SNP VM.
This vulnerability directly impacts the security model of SEV-SNP implementations by potentially allowing unauthorized access or manipulation of virtual machine states during migration operations. The improper state transfer could enable attackers to exploit inconsistencies in memory management and encryption contexts, undermining the fundamental security guarantees that SEV-SNP provides. According to CWE-284, this represents an improper access control vulnerability where the system fails to properly manage access to protected resources during state transitions.
The operational impact extends beyond simple migration failures to encompass potential data leakage and privilege escalation risks. When SNP VMs are moved between host locations without proper state initialization, the encryption context may become corrupted or improperly transferred, creating attack surfaces that adversaries could exploit to gain unauthorized access to encrypted virtual machine workloads. The mitigation strategy implemented involves rejecting SNP source VMs during migration or mirroring operations until complete SNP state transfer mechanisms are properly implemented and tested.
From an ATT&CK perspective, this vulnerability maps to techniques involving privilege escalation through hypervisor manipulation and credential exposure via improper state management. The fix enforces proper validation of VM types before allowing migration operations, preventing the execution of incomplete migration sequences that could lead to security breaches. This aligns with defensive strategies outlined in MITRE ATT&CK framework for virtualization and container environments, where maintaining consistent security contexts across VM migrations is critical for preventing lateral movement attacks.
The solution addresses the underlying architectural gap by ensuring that SNP VMs cannot be migrated or mirrored until all required SNP-specific state variables are properly handled. This prevents potential race conditions and inconsistent states that could occur during migration operations, while also ensuring that the proper ASID binding and memory management contexts remain intact throughout the virtual machine lifecycle. The implementation follows industry best practices for secure virtualization by maintaining strict separation of concerns between different VM types during migration processes.