CVE-2026-80651 Overview
CVE-2026-80651 is a NULL pointer dereference vulnerability in the Linux kernel's AMD Secure Encrypted Virtualization (SEV) trusted security manager (TSM) code. The flaw resides in the dsm_create() function within drivers/crypto/ccp/sev-dev-tsm.c. The function inconsistently handles a NULL pdev->bus pointer: it guards one access with a ternary check, then unconditionally dereferences the same pointer on the next lines. When pdev->bus is NULL, the kernel crashes during SEV Trusted I/O (TIO) setup. The static analyzer smatch flagged the inconsistent NULL handling.
Critical Impact
A NULL pdev->bus pointer triggers a kernel oops in dsm_create(), causing a denial of service on affected Linux kernel builds that use AMD SEV TIO functionality.
Affected Products
- Linux kernel builds with the AMD CCP sev-dev-tsm driver enabled
- Systems using AMD Secure Encrypted Virtualization Trusted I/O (SEV TIO) setup paths
- Kernel versions containing the pre-patch dsm_create() implementation in drivers/crypto/ccp/sev-dev-tsm.c
Discovery Timeline
- 2026-08-28 - CVE-2026-80651 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80651
Vulnerability Analysis
The vulnerability is a NULL Pointer Dereference in the Linux kernel's AMD CCP SEV device TSM driver. The dsm_create() function computes a segment_id using a defensive ternary check against pdev->bus:
u8 segment_id = pdev->bus ? pci_domain_nr(pdev->bus) : 0;
This line correctly anticipates that pdev->bus may be NULL. However, the two lines immediately after unconditionally dereference the same pointer. pcie_find_root_port() walks the bus hierarchy starting from pdev->bus, and pci_dev_id(pdev) expands to PCI_DEVID(dev->bus->number, dev->devfn). Both operations dereference pdev->bus without any check.
When pdev->bus is NULL, segment_id is initialized to 0, but the very next statement dereferences the NULL bus pointer and panics the kernel. The result is a denial of service on the affected host during SEV TIO device setup.
Root Cause
The root cause is inconsistent NULL pointer handling in a single function. The author added a NULL guard for one access to pdev->bus but forgot the same defensive check for subsequent dereferences through pcie_find_root_port() and pci_dev_id(). Static analysis by smatch produced the diagnostic: drivers/crypto/ccp/sev-dev-tsm.c:253 dsm_create() error: we previously assumed 'pdev->bus' could be null (see line 251).
Attack Vector
Exploitation requires a PCI device state in which pdev->bus is NULL at the time dsm_create() runs during SEV TIO initialization. This condition is not reachable from unauthenticated remote input and is triggered by kernel-internal device enumeration state. The consequence is a local denial of service through a kernel crash rather than code execution or information disclosure. See the upstream patches for the exact code paths that were hardened.
For technical details, review the upstream fixes in the Kernel Git Commit 6bafd740 and the Kernel Git Commit 930d9d36.
Detection Methods for CVE-2026-80651
Indicators of Compromise
- Kernel oops or panic messages referencing dsm_create in drivers/crypto/ccp/sev-dev-tsm.c in dmesg or journalctl -k output
- NULL pointer dereference stack traces containing pcie_find_root_port or pci_dev_id called from the SEV CCP driver
- Unexpected host reboots or hangs on AMD EPYC systems during SEV TIO device initialization
Detection Strategies
- Inventory Linux hosts running AMD EPYC processors with SEV TIO enabled and identify kernels that predate the two upstream commits referenced above.
- Run smatch or an equivalent static analyzer against drivers/crypto/ccp/sev-dev-tsm.c to confirm the diagnostic on line 253 is absent after patching.
- Correlate crash telemetry from monitored Linux endpoints with kernel version and CCP driver load events to isolate exposed hosts.
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on panics that reference the ccp or sev-dev-tsm modules.
- Track kernel package versions across the fleet and flag hosts that have not received the fix.
- Monitor for repeated host resets on AMD SEV capable virtualization hosts, which may indicate the crash is being triggered.
How to Mitigate CVE-2026-80651
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the NVD entry for CVE-2026-80651 to all affected hosts.
- Update to a distribution kernel package that includes both 6bafd740095f and 930d9d36ea61 commits.
- Reboot affected systems after patching so the new kernel image is loaded.
Patch Information
The fix makes NULL handling consistent inside dsm_create(). When pdev->bus is NULL, the device has no PCI context for SEV TIO setup, so the function returns -ENODEV before any bus-dependent lookup. The remaining initialization runs only when pdev->bus is valid. Callers where pdev->bus is non-NULL see no behavioral change. Patches are available in the Kernel Git Commit 6bafd740 and Kernel Git Commit 930d9d36.
Workarounds
- Disable AMD SEV TIO functionality on affected hosts until the patched kernel can be deployed, if the workload does not require it.
- Unload or blocklist the ccp kernel module on systems where SEV TIO is not in use, following vendor guidance for any hardware crypto dependencies.
- Restrict privileged local access to reduce the risk of an attacker maneuvering the system into a state where the crash path can be reached.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
