LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed When retrieving the ID for the CPU, don't attempt to copy the ID blob to userspace if the firmware command failed. If the failure was due to an invalid length, i.e. the userspace buffer+length was too small, copying the number of bytes _firmware_ requires will overflow the kernel-allocated buffer and leak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388 CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 Call Trace: <TASK> dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 copy_to_user ../include/linux/uaccess.h:236 [inline] sev_ioctl_do_get_id2+0x361/0x490 ../drivers/crypto/ccp/sev-dev.c:2222 sev_ioctl+0x25f/0x490 ../drivers/crypto/ccp/sev-dev.c:2575 vfs_ioctl ../fs/ioctl.c:51 [inline] __do_sys_ioctl ../fs/ioctl.c:597 [inline] __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> WARN if the driver says the command succeeded, but the firmware error code says otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any firwmware error.

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local, low-privileged user may trigger the Linux AMD security processor driver to copy beyond an allocated kernel buffer. This can expose sensitive kernel memory to userspace and may disrupt the host. The issue is not remotely exploitable according to the supplied CVSS vector.

Executive priority

Treat as high priority on multi-user or shared AMD virtualization hosts exposing the SEV interface. Other systems should be assessed promptly, but remote-only attackers cannot directly trigger the documented flaw. Schedule a supported kernel update after confirming vendor applicability.

Technical view

The SEV_GET_ID2 ioctl path copied a firmware-requested length after a PSP command failure caused by an undersized userspace buffer. Because the allocated kernel buffer was smaller, copy_to_user performed an out-of-bounds read. The kernel fix prevents copying the ID blob when the PSP command fails.

Likely exposure

Exposure requires an affected Linux kernel, local low-privileged access, and access to the relevant AMD SEV/CCP device interface. The supplied affected-version data spans multiple kernel branches but is insufficient to map every distribution package reliably. Containers or tenants able to reach the device may increase concern.

Exploitation context

The CVSS score is 7.1 with local access, low complexity, low privileges, no user interaction, high confidentiality impact, and high availability impact. KEV is false, and the supplied sources provide no evidence of active exploitation or a public exploit.

Researcher notes

The demonstrated failure is a 64-byte slab out-of-bounds read in sev_ioctl_do_get_id2 after firmware reports an invalid length. The record supplies eight stable-tree fixes. Exact introduction and fixed-version boundaries are unclear from the flattened affected-version data, so downstream vendor advisories remain necessary.

Mitigation direction

  • Update to a vendor-supported kernel containing the applicable listed stable fix.
  • Consult your Linux distributor for exact patched package versions and reboot requirements.
  • Restrict untrusted users and workloads from accessing the relevant SEV/CCP device interface.
  • Prioritize shared hosts where less-trusted tenants or local users can access that interface.

Validation and detection

  • Inventory kernel versions and compare package status with distributor guidance.
  • Confirm whether AMD SEV/CCP support and its userspace device interface are enabled and accessible.
  • Verify the installed kernel contains the applicable stable fix commit.
  • After updating, confirm the host booted into the patched kernel.
  • Review kernel logs for KASAN, copy_to_user, sev_ioctl, or slab-out-of-bounds reports.
Prepared
Confidence
high
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31697 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2026-31697Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd6112ea0cb344d6f5ed519991e24f69ba4b43d0e, d6112ea0cb344d6f5ed519991e24f69ba4b43d0e, d6112ea0cb344d6f5ed519991e24f69ba4b43d0e, d6112ea0cb344d6f5ed519991e24f69ba4b43d0e, d6112ea0cb344d6f5ed519991e24f69ba4b43d0e, d6112ea0cb344d6f5ed519991e24f69ba4b43d0e, d6112ea0cb344d6f5ed519991e24f69ba4b43d0e, d6112ea0cb344d6f5ed519991e24f69ba4b43d0eunaffected
LinuxLinux5.2, 0, 5.10.258, 5.15.209, 6.1.175, 6.6.136, 6.12.84, 6.18.25, 7.0.2, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.