crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed When retrieving the PEK CSR, don't attempt to copy the blob to userspace if the firmware command failed. If the failure was due to an invalid length, i.e. the userspace buffer+length was too small, copying the number of bytes _firmware_ requires will overflow the kernel-allocated buffer and leak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 2084 at addr ffff898144612e20 by task syz.9.219/21405 CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 Call Trace: dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../lib/user
CVE-2026-31699
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-31699
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "e799035609e1526761aa2f896a974b233d04d36d",
"lessThan": "502d10a1d9d477e6c7fc7021a2dac7018f4ab8b5",
"versionType": "git"
},
{
"status": "affected",
"version": "e799035609e1526761aa2f896a974b233d04d36d",
"lessThan": "0fb87e44b81385f940b482cba5b3f0bd18fb8185",
"versionType": "git"
},
{
"status": "affected",
"version": "e799035609e1526761aa2f896a974b233d04d36d",
"lessThan": "372116eece159adff631b1508344c8b85ebf9559",
"versionType": "git"
},
{
"status": "affected",
"version": "e799035609e1526761aa2f896a974b233d04d36d",
"lessThan": "607ba280f2adb5092cf5386c3935afac2ca0031a",
"versionType": "git"
},
{
"status": "affected",
"version": "e799035609e1526761aa2f896a974b233d04d36d",
"lessThan": "59e9ae81f8670ccc780bc75f45a355736f640ec9",
"versionType": "git"
},
{
"status": "affected",
"version": "e799035609e1526761aa2f896a974b233d04d36d",
"lessThan": "111dcc6d0f016076745824a787d25609d0022f4c",
"versionType": "git"
},
{
"status": "affected",
"version": "e799035609e1526761aa2f896a974b233d04d36d",
"lessThan": "3b4fd8f15765d9a3105b834dba8a05d025e5e16e",
"versionType": "git"
},
{
"status": "affected",
"version": "e799035609e1526761aa2f896a974b233d04d36d",
"lessThan": "abe4a6d6f606113251868c2c4a06ba904bb41eed",
"versionType": "git"
}
],
"programFiles": [
"drivers/crypto/ccp/sev-dev.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.16",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.84",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.25",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.2",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/crypto/ccp/sev-dev.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-31699
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #39984 · Revision 1
- Added to Heist Feed
- Publisher date