crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed When retrieving the ID for the CPU, don't attempt to copy the ID blob to userspace if the firmware command failed. If the failure was due to an invalid length, i.e. the userspace buffer+length was too small, copying the number of bytes _firmware_ requires will overflow the kernel-allocated buffer and leak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388 CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 Call Trace: dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../
CVE-2026-31697
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-31697
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
"lessThan": "99bae2e3c3f9ba8f854c938ed2c811b6a63b28e4",
"versionType": "git"
},
{
"status": "affected",
"version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
"lessThan": "a21ae9f8769e5f75433bb0a85ac3868b2100ef5b",
"versionType": "git"
},
{
"status": "affected",
"version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
"lessThan": "0f1f2f9894893dc8a28af1b9e9dbc0abf453eb52",
"versionType": "git"
},
{
"status": "affected",
"version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
"lessThan": "09427bcb1715fb20a80b6acd5156dbf15ab5c363",
"versionType": "git"
},
{
"status": "affected",
"version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
"lessThan": "1fbac0429a42adec830491757a2b53956dd797ea",
"versionType": "git"
},
{
"status": "affected",
"version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
"lessThan": "2937f17bbeefb8e7608ff1f78cffbeb3d0281e5e",
"versionType": "git"
},
{
"status": "affected",
"version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
"lessThan": "06f06d88c05ce176c61fff8c72c372847b0dd2b5",
"versionType": "git"
},
{
"status": "affected",
"version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
"lessThan": "4f685dbfa87c546e51d9dc6cab379d20f275e114",
"versionType": "git"
}
],
"programFiles": [
"drivers/crypto/ccp/sev-dev.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.84",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.25",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.2",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/crypto/ccp/sev-dev.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-31697
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #39956 · Revision 1
- Added to Heist Feed
- Publisher date