Bug 2559572 (CVE-2026-98871)

Summary: CVE-2026-98871 kernel: crypto: ccp - Fix possible deadlock in SEV init failure path
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's AMD Cryptographic Coprocessor (CCP) driver. This vulnerability can lead to a Denial of Service (DoS) due to a deadlock during AMD Secure Encrypted Virtualization (SEV) platform initialization. When an error occurs while configuring firmware memory, improper lock handling in the cleanup path causes the kernel to wait indefinitely on an already acquired lock. A local privileged user capable of triggering this initialization failure can exploit this flaw to hang the system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-23 12:04:44 UTC 
In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Fix possible deadlock in SEV init failure path

__sev_platform_init_handle_init_ex_path() calls
rmp_mark_pages_firmware() with locked=false while the parent
function of init_ex_path already acquired the sev_cmd_mutex.
In the case of an RMPUPDATE failure for any page after the first, the cleanup
path would invoke reclaim pages which would result in a deadlock in
sev_do_cmd.

Pass locked=true to honor the lock status of the parent function.
Comment 1 Mauro Matteo Cascella 2026-10-26 09:42:00 UTC 
Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98871.mbox