Linux Kernel sev x86/virt/sev/sev.c wbinvd_on_all_cpus state issue

Summaryinfo

A vulnerability labeled as very critical has been found in Linux Kernel. Affected is the function wbinvd_on_all_cpus of the file x86/virt/sev/sev.c of the component sev. Such manipulation leads to state issue. This vulnerability is traded as CVE-2026-72239. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Linux Kernel (the affected version unknown). It has been rated as very critical. Affected by this issue is the function wbinvd_on_all_cpus of the file x86/virt/sev/sev.c of the component sev. The manipulation with an unknown input leads to a state issue vulnerability. Using CWE to declare the problem leads to CWE-371. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN" Revert 99cf1fb58e68 ("x86/virt/sev: Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"). Section 8.8 of the SNP spec says: Before invoking SNP_INIT_EX with INIT_RMP set to 1, software must ensure that no CPUs contain dirty cache lines for the memory containing the RMP. Cachelines can be moved from cache to cache in a dirty state. The wbinvd_on_all_cpus() before SNP_INIT_EX flushes the caches for each CPU, but if the IPIs for WBINVD race with this dirty cacheline movement, it is possible that they may not get flushed, violating the firmware requirement. Doing wbinvd_on_all_cpus() before setting SNPEn is safer since the RMP table is not yet in use. [ Heroically bisected by Srikanth. ] [ bp: Massage commit message. ]

The advisory is available at git.kernel.org. This vulnerability is handled as CVE-2026-72239 since 08/09/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 08/15/2026).

Applying the patch e5158ff53fdff9c229bf13aa5f75eb17cdcfcd2d/99cf1fb58e68 is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion