Skip to content
Heist/ feed
High

crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed When retrieving the ID for the CPU, don't attempt to copy the ID blob to userspace if the firmware command failed. If the failure was due to an invalid length, i.e. the userspace buffer+length was too small, copying the number of bytes _firmware_ requires will overflow the kernel-allocated buffer and leak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388 CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 Call Trace: dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../

Announced Source revision 1
Original source ↗

CVE-2026-31697

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-31697

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
        "lessThan": "99bae2e3c3f9ba8f854c938ed2c811b6a63b28e4",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
        "lessThan": "a21ae9f8769e5f75433bb0a85ac3868b2100ef5b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
        "lessThan": "0f1f2f9894893dc8a28af1b9e9dbc0abf453eb52",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
        "lessThan": "09427bcb1715fb20a80b6acd5156dbf15ab5c363",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
        "lessThan": "1fbac0429a42adec830491757a2b53956dd797ea",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
        "lessThan": "2937f17bbeefb8e7608ff1f78cffbeb3d0281e5e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
        "lessThan": "06f06d88c05ce176c61fff8c72c372847b0dd2b5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
        "lessThan": "4f685dbfa87c546e51d9dc6cab379d20f275e114",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/crypto/ccp/sev-dev.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.2"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.2",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.258",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.209",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.175",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.136",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.84",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.25",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.0.2",
        "versionType": "semver",
        "lessThanOrEqual": "7.0.*"
      },
      {
        "status": "unaffected",
        "version": "7.1",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/crypto/ccp/sev-dev.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-31697

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#39956 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement