Executive brief
The Linux kernel's cryptographic coprocessor (CCP) driver does not properly handle zero-length certificate chain buffers when exporting Platform Diffie-Hellman (PDH) data, causing a system crash under certain debug configurations. While this crashes the affected process, it cannot be exploited to gain unauthorized access or cause persistent system damage under normal configurations.
Technical details
The vulnerability is a missing bounds check in the CCP SEV-dev module's PDH export ioctl handler. When userspace passes a zero-length certificate chain buffer, the driver attempts to allocate zero bytes using kzalloc() (which returns ZERO_SIZE_PTR), then tries to obtain its physical address for DMA operations. When CONFIG_DEBUG_VIRTUAL=y is enabled, this triggers a BUG_ON() in __phys_addr(). Under normal configurations (without this debug option), the PSP hardware returns an error before any memory corruption occurs, but the underlying logic does not distinguish between a zero-length buffer and a legitimate query for blob lengths. The vulnerability requires local access to the SEV ioctl interface (/dev/sev) and affects only the denial-of-service path; no privilege escalation or data exfiltration is possible.
Affected products
- Linux Linux kernel 6.18.16 and others with CCP SEV-dev module
Timeline
- 2026-08-28: disclosed
- 2026-08-28: advisory