CVE-2026-31698
Buffer Overflow in Linux Kernel CCP Driver
Publication date: 2026-05-01
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.7 (inc) to 6.12.84 (exc) |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.25 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 7.0.2 (exc) |
| linux | linux_kernel | From 4.16 (inc) to 6.6.136 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's crypto CCP driver when handling the retrieval of the Platform Diffie-Hellman (PDH) certificate. If the firmware command to get the PDH certificate fails, especially due to an invalid length (meaning the userspace buffer is too small), the kernel incorrectly attempts to copy more data than the allocated kernel buffer can hold. This results in a buffer overflow and causes data leakage from the kernel space to userspace.
The issue arises because the driver does not properly check the firmware command's failure before copying data, leading to out-of-bounds memory access and potential exposure of sensitive kernel memory.
How can this vulnerability impact me? :
This vulnerability can lead to a kernel memory buffer overflow and data leakage to userspace. An attacker or malicious userspace process could exploit this flaw to read sensitive kernel memory contents that should not be accessible, potentially exposing confidential information or kernel data structures.
Such data leakage can undermine system security by revealing secrets or internal kernel state, which could be leveraged for further attacks or privilege escalation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a kernel buffer overflow triggered when the PDH certificate retrieval fails due to an invalid length, causing a slab-out-of-bounds error in kernel memory. Detection would typically involve monitoring kernel logs for KASAN (Kernel Address Sanitizer) slab-out-of-bounds warnings related to the crypto CCP driver, specifically messages referencing instrument_copy_to_user or sev_ioctl functions.
You can check the kernel logs for such errors using commands like:
- dmesg | grep -i kasan
- journalctl -k | grep -i kasan
- grep -r 'slab-out-of-bounds' /var/log/
Additionally, monitoring for unusual ioctl calls to the sev device or abnormal behavior in the crypto CCP driver may help identify attempts to exploit this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved in the Linux kernel by ensuring that the PDH certificate is not copied to userspace if the firmware command fails, preventing buffer overflow and data leakage.
Immediate mitigation steps include:
- Update your Linux kernel to the version that includes the fix for this vulnerability.
- Avoid running untrusted or suspicious userspace applications that interact with the crypto CCP driver or perform PDH certificate retrieval until the patch is applied.
- Monitor kernel logs for any signs of exploitation attempts and restrict access to the affected device interfaces if possible.