Executive brief
The Linux kernel's crypto subsystem contains an off-by-one error in the SNP (Secure Nested Paging) memory region filtering code used by AMD processors. An attacker with local access could exploit this to overflow a heap buffer, potentially leading to privilege escalation or system crash. This affects systems using AMD Secure Encrypted Virtualization with SEV-SNP support.
Technical details
The vulnerability is an off-by-one error in the snp_filter_reserved_mem_regions() function in drivers/crypto/ccp/sev-dev.c. The bounds check failed to account for the next entry being written to the buffer, allowing writes beyond the PAGE_SIZE-allocated heap buffer. Specifically, when range_list->num_elements is 255, the check allowed 4088 bytes to be written (255 * 16 + 8), leaving only 8 bytes in the page, but the code then wrote 12 additional bytes (an 8-byte base field plus a 4-byte page_count field), causing a 4-byte heap overflow. The fix modifies the bounds check to use (num_elements + 1) instead of num_elements, accounting for the entry about to be written. The vulnerability requires local code execution context to trigger the vulnerable code path.
Affected products
- Linux Linux kernel various (patched in 6.6.y, 6.7.y, 6.8.y, 6.9.y and later stable branches)
Timeline
- 2026-08-15: disclosed: CVE-2026-74404 published
- 2026-04-08: patched: Fix committed upstream (commit 1b864b6cb213bbd7b406e9b2e98c962077f300df)
- 2026-07-24: patched: Fix backported to stable kernels