I also experienced this bug (unresponsive guest, blank console, pegged CPU) when booting SEV guests on Ubuntu 26.04 with ovmf images that enable both nvram and secure boot:
OVMF_CODE_4M.ms.fd - symlinked to OVMF_CODE_4M.secboot.fd - similar image in Fedora is OVMF_CODE.secboot.fd which is also affected However, the following ovmf images work fine: OVMF_CODE_4M.fd - nvram yes - secure boot no - similar image in Fedora is OVMF_CODE.fd which also works fine OVMF.amdsev.fd - stateless - secure boot no - supports SEV launch secret - packaged in Debian unstable (ovmf-amdsev), Ubuntu 26.04 (ovmf-amdsev), Fedora 44 (edk2-ovmf) OVMF.stateless.fd - stateless - secure boot supported but disabled - packaged in Fedora 44 (edk2-ovmf) OVMF.stateless.secboot.fd - stateless - secure boot enabled with Microsoft and Red Hat keys - packaged in Fedora 44 (edk2-ovmf) So for now I would suggest either using OVMF.amdsev.fd from sid or OVMF.stateless.secboot.fd from Fedora (and in the future adding the stateless secure boot build config to Debian). For OVMF.amdsev.fd, you can use it with direct kernel boot and passing LUKS key as a launch secret, e.g., for legacy SEV after verifying SEV certificate and generating session keys with sevctl and launch measurement with virt-qemu-sev-validate. For OVMF.stateless.secboot.fd, you can modify it to hard-code the secure boot keys with virt-fw-vars from python3-virt-firmware package.
