crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed When retrieving the PDH cert, don't attempt to copy the blobs to userspace if the firmware command failed. If the failure was due to an invalid length, i.e. the userspace buffer+length was too small, copying the number of bytes _firmware_ requires will overflow the kernel-allocated buffer and leak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 2084 at addr ffff8885c4ab8aa0 by task syz.0.186/21033 CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025 Call Trace: dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../
CVE-2026-31698
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-31698
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436",
"lessThan": "af67d35da744b6b678c7a0296d9c679658779829",
"versionType": "git"
},
{
"status": "affected",
"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436",
"lessThan": "854d7846e1d29f32f1bbeb2e869e794df12067f6",
"versionType": "git"
},
{
"status": "affected",
"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436",
"lessThan": "25d9b3446001185484209cf57951f3368462b631",
"versionType": "git"
},
{
"status": "affected",
"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436",
"lessThan": "b5c14bd4da1f376f385722fe1da993f1edab6472",
"versionType": "git"
},
{
"status": "affected",
"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436",
"lessThan": "78b97e43d0b3e674d9d49ae56937b11e2ba3fcaf",
"versionType": "git"
},
{
"status": "affected",
"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436",
"lessThan": "051e51aa55fd4cdc3e8283cf4476aeeb5f563274",
"versionType": "git"
},
{
"status": "affected",
"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436",
"lessThan": "50808c13452dae43a2c90b1bbbf9daa16501ce70",
"versionType": "git"
},
{
"status": "affected",
"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436",
"lessThan": "e76239fed3cffd6d304d8ca3ce23984fd24f57d3",
"versionType": "git"
}
],
"programFiles": [
"drivers/crypto/ccp/sev-dev.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.16",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.84",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.25",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.2",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/crypto/ccp/sev-dev.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-31698
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #39983 · Revision 1
- Added to Heist Feed
- Publisher date