LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed When retrieving the PDH cert, don't attempt to copy the blobs to userspace if the firmware command failed. If the failure was due to an invalid length, i.e. the userspace buffer+length was too small, copying the number of bytes _firmware_ requires will overflow the kernel-allocated buffer and leak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 2084 at addr ffff8885c4ab8aa0 by task syz.0.186/21033 CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025 Call Trace: <TASK> dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 copy_to_user ../include/linux/uaccess.h:236 [inline] sev_ioctl_do_pdh_export+0x3d3/0x7c0 ../drivers/crypto/ccp/sev-dev.c:2347 sev_ioctl+0x2a2/0x490 ../drivers/crypto/ccp/sev-dev.c:2568 vfs_ioctl ../fs/ioctl.c:51 [inline] __do_sys_ioctl ../fs/ioctl.c:597 [inline] __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> WARN if the driver says the command succeeded, but the firmware error code says otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any firwmware error.

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in the Linux AMD Secure Encrypted Virtualization driver can expose kernel memory when certificate retrieval fails and the supplied buffer is too small. A locally authenticated user with access to the relevant driver interface may obtain sensitive data or disrupt the system. It is not a remote vulnerability.

Executive priority

Treat this as a high-priority platform update for AMD SEV hosts, especially multi-user or shared virtualization systems. It requires local access, reducing internet-scale urgency, but potential kernel-memory disclosure and availability impact justify prompt remediation. Systems without the relevant AMD SEV driver path are lower priority after validation.

Technical view

The SEV PDH export ioctl copied the firmware-required length to userspace after a failed PSP command. When that length exceeded the kernel allocation, copy_to_user performed a slab out-of-bounds read. CVSS 3.1 is 7.1: local, low complexity, low privileges, no interaction, with high confidentiality and availability impact but no integrity impact.

Likely exposure

Exposure is concentrated on Linux systems using the AMD CCP/PSP SEV functionality where a low-privileged local user can access the relevant ioctl. The bundle identifies multiple affected kernel branches, but its version data is insufficiently structured to define a reliable universal range. Distribution backports must be checked individually.

Exploitation context

The supplied sources provide a KASAN reproducer trace demonstrating the out-of-bounds read. They do not report public weaponization or active exploitation, and the CVE is not listed as KEV in the bundle. Practical exploitation beyond triggering the defect is not established here.

Researcher notes

The demonstrated condition is a slab out-of-bounds read in sev_ioctl_do_pdh_export after firmware failure caused by an inadequate userspace buffer length. The correction prevents blob copying when the PSP command fails and warns on inconsistent driver and firmware status. The sources do not establish leaked-data contents, reliable denial of service, or exploitation in production.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable Linux stable fix or distribution backport.
  • Map the running kernel to vendor advisories and the cited stable commits before declaring remediation complete.
  • Restrict untrusted local access to AMD SEV management interfaces until affected systems are updated.
  • Prioritize shared virtualization hosts because kernel-memory disclosure may cross important security boundaries.

Validation and detection

  • Inventory kernel versions and identify hosts using AMD CCP, PSP, or SEV functionality.
  • Confirm each distribution kernel includes the applicable cited fix, accounting for vendor backports.
  • Review device permissions and service access controlling the SEV ioctl interface.
  • Check kernel logs and monitoring for PSP failures, SEV ioctl errors, KASAN reports, or unexplained crashes.
Prepared
Confidence
high
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31698 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2026-31698Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux76a2b524a4b1d6dc0f2421f9854a01d55d5e5436, 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436, 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436, 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436, 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436, 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436, 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436, 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436unaffected
LinuxLinux4.16, 0, 5.10.258, 5.15.209, 6.1.175, 6.6.136, 6.12.84, 6.18.25, 7.0.2, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.