Executive brief
The Linux kernel's AMD CCP (Crypto Coprocessor) driver contains a memory allocation error-checking bug in the Secure Encrypted Virtualization (SEV) initialization code. Under memory pressure, a failed page allocation can result in invalid pointer dereferencing, potentially causing kernel panics or system crashes. This affects systems using SEV-TIO (Trusted I/O) features on AMD processors.
Technical details
The vulnerability is a null-pointer dereference in drivers/crypto/ccp/sev-dev.c within the __sev_snp_init_locked() function. The bug occurs because the code calls page_address(NULL) on a failed allocation without checking the page pointer first. On architectures without HASHED_PAGE_VIRTUAL, page_address(NULL) may return a non-NULL garbage value, which then passes a subsequent validity check and is dereferenced, causing undefined behavior. The vulnerable code path is reached when __snp_alloc_firmware_pages() returns NULL due to memory pressure and TIO is enabled (data.tio_en). The fix checks the page allocation for NULL before calling page_address(), preventing the dereference of invalid memory. The vulnerability was introduced in commit 4be423572da1 and patched in commit a8d5370eef00eca132a292b1901c9914c817e385.
Affected products
- Linux Linux kernel All versions with SEV-TIO support (introduced in 4be423572da1)
Timeline
- 2026-04-08: other: Patch committed by Tycho Andersen (AMD)
- 2026-05-07: patched: Patch merged upstream in commit a8d5370eef00eca132a292b1901c9914c817e385
- 2026-07-24: patched: Patch backported to stable tree (commit 17e1aae19a06d9f6da4b46d54fa2aeab77ec0c69)
- 2026-08-15: disclosed: CVE-2026-74403 published