CVE-2026-90040

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM SEV implementation where the SNP VMSA (Virtual Machine Save Area) is not forcefully invalidated when its backing gmem page is zapped, such as during a PUNCH HOLE operation. Failure to invalidate the control.vmsa pa variable, which is verified by the pre sev run() function, prevents the system from properly freeing the page. This occurs because the firmware rejects the RMPUPDATE (Reverse Map Table update) to reclaim the page with a FAIL INUSE error if the vCPU is actively running. Consequently, this leads to an RMP page fault on subsequent use as the page remains assigned to the SNP VM.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.