Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2026-72239x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"

Description

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN" Revert 99cf1fb58e68 ("x86/virt/sev: Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"). Section 8.8 of the SNP spec says: Before invoking SNP_INIT_EX with INIT_RMP set to 1, software must ensure that no CPUs contain dirty cache lines for the memory containing the RMP. Cachelines can be moved from cache to cache in a dirty state. The wbinvd_on_all_cpus() before SNP_INIT_EX flushes the caches for each CPU, but if the IPIs for WBINVD race with this dirty cacheline movement, it is possible that they may not get flushed, violating the firmware requirement. Doing wbinvd_on_all_cpus() before setting SNPEn is safer since the RMP table is not yet in use. [ Heroically bisected by Srikanth. ] [ bp: Massage commit message. ]

Timeline

  1. ID reserved

    By Linux

  2. · 6 days later

    Published

  3. · 2 days later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-72239, by who scored it
Scored byCVSSScoreVector
LinuxCNA (assigner)3.1Critical9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVDNVD · Received3.1Critical9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.18% · top 92% of all CVEs (13 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Affected products

  • Linux · Linux

    • affected 99cf1fb58e68291d408b4c4484181cf88f081857 – < e5158ff53fdff9c229bf13aa5f75eb17cdcfcd2d
    • affected 99cf1fb58e68291d408b4c4484181cf88f081857 – < 4c2509f3b79756679a02bea649c6a7501b58f52c

  • Linux · Linux

    • affected 7.1
    • unaffected < 7.1
    • unaffected 7.1.5 – ≤ 7.1.*
    • unaffected 7.2 – ≤ *

References

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-72239 badge
[![CVE-2026-72239](https://cveledger.app/badge/CVE-2026-72239.svg)](https://cveledger.app/cve/CVE-2026-72239)

Record last updated .