Junglewise Threat Intelligence

CVE-2026-31699: Linux Kernel out-of-bounds access in CCP SEV_PEK_CSR ioctl

CVE-2026-31699 · Severity: high · CVSS 7.1 · Published 2026-05-01

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's cryptographic component could allow a local attacker to access sensitive information or cause a system crash. The issue occurs when the system handles requests for security certificates on AMD processors using Secure Encrypted Virtualization (SEV). If an attacker provides an improperly sized data buffer, the system may leak internal kernel memory or fail, potentially compromising the confidentiality of the system's security operations.

Technical details

An out-of-bounds (OOB) memory access vulnerability exists in the Linux kernel's 'drivers/crypto/ccp/sev-dev.c' component. The root cause is a failure to validate the success of a Platform Security Processor (PSP) firmware command before attempting to copy a Certificate Signing Request (CSR) blob back to userspace. If the firmware command fails due to an insufficient buffer length provided by the user, the driver incorrectly uses the firmware-reported required length to perform a 'copy_to_user' operation from a smaller kernel-allocated buffer. This results in a slab-out-of-bounds read, potentially leaking sensitive kernel data or causing a kernel panic (DoS). The vulnerability is reachable via the SEV_PEK_CSR ioctl. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 4.16 to 6.6.136, 6.7 to 6.12.84, 6.13 to 6.18.25, 6.19 to 7.0.2

Timeline

  • 2026-03-13: other: Patch authored
  • 2026-05-01: disclosed: Initial disclosure and CVE assignment
  • 2026-06-01: patched: Final stable branch patches committed

References