Junglewise Threat Intelligence

CVE-2026-31698: Linux Kernel CCP out-of-bounds access in SEV PDH export

CVE-2026-31698 · Severity: high · CVSS 7.1 · Published 2026-05-01

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's cryptographic subsystem could allow a local attacker to access sensitive kernel memory. The issue occurs when the system attempts to export security certificates (PDH certs) used for AMD Secure Encrypted Virtualization (SEV). If an application provides a buffer that is too small, the system may inadvertently leak extra data from the kernel into the application's memory space, potentially exposing secrets or causing a system crash.

Technical details

An out-of-bounds (OOB) memory access vulnerability exists in the Linux kernel's CCP driver (drivers/crypto/ccp/sev-dev.c) within the `sev_ioctl_do_pdh_export` function. The root cause is a failure to validate the return status of a Platform Security Processor (PSP) firmware command before proceeding with a `copy_to_user` operation. If the firmware command fails due to an insufficient buffer length provided by userspace, the driver incorrectly uses the firmware-reported required length to perform the copy operation. This results in a slab-out-of-bounds read from a kernel-allocated buffer, leaking adjacent kernel memory to userspace. The vulnerability can be triggered by a local user with access to the SEV ioctl interface. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 4.16 to 6.6.136, 6.7 to 6.12.84, 6.13 to 6.18.25, 6.19 to 7.0.2

Timeline

  • 2026-03-13: patched: Initial patch authored by Sean Christopherson
  • 2026-05-01: advisory: CVE-2026-31698 published

References