CVE-2026-31699

HIGH EPSS 2.6%
Published May 1, 20262mo ago · Modified Jun 17, 20261w ago
7.1 CVSS 3.1
High
Find Similar
Published May 1, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed When retrieving the PEK CSR, don't attempt to copy the blob to userspace if the firmware command failed. If the failure was due to an invalid length, i.e. the userspace buffer+length was too small, copying the number of bytes _firmware_ requires will overflow the kernel-allocated buffer and leak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 2084 at addr ffff898144612e20 by task syz.9.219/21405 CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 Call Trace: <TASK> dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 copy_to_user ../include/linux/uaccess.h:236 [inline] sev_ioctl_do_pek_csr+0x31f/0x590 ../drivers/crypto/ccp/sev-dev.c:1872 sev_ioctl+0x3a4/0x490 ../drivers/crypto/ccp/sev-dev.c:2562 vfs_ioctl ../fs/ioctl.c:51 [inline] __do_sys_ioctl ../fs/ioctl.c:597 [inline] __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> WARN if the driver says the command succeeded, but the firmware error code says otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any firwmware error.

CVSS Details

Base Score
7.1
Exploitability
1.8
Impact
5.2
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
2.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 6

VendorProductVersionRange
linuxlinux_kernel*≥4.16  –  <6.6.136
linuxlinux_kernel*≥6.7  –  <6.12.84
linuxlinux_kernel*≥6.13  –  <6.18.25
linuxlinux_kernel*≥6.19  –  <7.0.2
linuxlinux_kernel7.1any
linuxlinux_kernel7.1any

References 8

  • git.kernel.org https://git.kernel.org/stable/c/0fb87e44b81385f940b482cba5b3f0bd18fb8185
  • git.kernel.org https://git.kernel.org/stable/c/111dcc6d0f016076745824a787d25609d0022f4c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/372116eece159adff631b1508344c8b85ebf9559
  • git.kernel.org https://git.kernel.org/stable/c/3b4fd8f15765d9a3105b834dba8a05d025e5e16e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/502d10a1d9d477e6c7fc7021a2dac7018f4ab8b5
  • git.kernel.org https://git.kernel.org/stable/c/59e9ae81f8670ccc780bc75f45a355736f640ec9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/607ba280f2adb5092cf5386c3935afac2ca0031a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/abe4a6d6f606113251868c2c4a06ba904bb41eed
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/111dcc6d0f016076745824a787d25609d0022f4c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3b4fd8f15765d9a3105b834dba8a05d025e5e16e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/59e9ae81f8670ccc780bc75f45a355736f640ec9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/607ba280f2adb5092cf5386c3935afac2ca0031a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/abe4a6d6f606113251868c2c4a06ba904bb41eed
    Patch