Why is the security of lattice cryptosystems not provable from $P \neq NP$? My understanding is that the Shortest Vector Problem ($\text{SVP}$) is $\text{NP}$-hard.  Therefore, $\text{LWE}$ is also $\text{NP}$-hard.  But $\text{LWE}$ is hard on average if it is hard in the worst case, so breaking certain cryptosystems based on it is also $\text{NP}$-hard, which means that secure asymmetric encryption is not only possible but known, unless $\text{P} = \text{NP}$!

That would be a rather striking result, and to my knowledge it has not been clamed in a serious paper.  What is the flaw in my reasoning?
To expand somewhat on Sasho Nikolov's comment...


  LWE is at least as hard as finding approximate solutions to SVP, but the approximation factors for which the reduction from SVP to LWE works are larger than the approximation factors for which we know NP-hardness


...the following is a reasonably complete view of things:



This was part of Oded Regev's talk at the Winter School on Lattice-Based Cryptography and Applications, held at Bar-Ilan University, Israel, in 2012.

If you are interested in a good introduction to the very basics of lattice cryptography, I'd happily recommend checking out the full record of this winter school. You can (still-- as of Summer 2017) find a large list of slides and talk videos at:

https://cyber.biu.ac.il/event/the-2nd-biu-winter-school/