CVE-2026-31699
Buffer Overflow in Linux Kernel Crypto CCP Driver
Publication date: 2026-05-01
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.7 (inc) to 6.12.84 (exc) |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.25 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 7.0.2 (exc) |
| linux | linux_kernel | From 4.16 (inc) to 6.6.136 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's crypto CCP driver when retrieving the PEK CSR (Certificate Signing Request). If the firmware command to get the CSR fails due to an invalid length (meaning the userspace buffer is too small), the kernel incorrectly attempts to copy more data than the allocated buffer size. This causes a buffer overflow in the kernel memory and can leak sensitive data to userspace.
How can this vulnerability impact me? :
The vulnerability can lead to a kernel buffer overflow and data leakage. Specifically, if exploited, it may allow unauthorized userspace processes to access kernel memory contents that should be protected, potentially exposing sensitive information and compromising system security.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a kernel buffer overflow triggered when the firmware command to retrieve the PEK CSR fails but the driver attempts to copy data to userspace regardless. Detection would involve monitoring kernel logs for related error messages or warnings.
Specifically, look for kernel warnings or BUG reports mentioning slab-out-of-bounds errors in functions like instrument_copy_to_user, _copy_to_user, or sev_ioctl related to the crypto CCP driver.
Commands to check kernel logs for such errors include:
- dmesg | grep -i 'slab-out-of-bounds'
- journalctl -k | grep -i 'sev_ioctl'
- journalctl -k | grep -i 'kasan_report'
Additionally, monitoring for unexpected firmware error codes or ioctl failures related to the CCP crypto driver may help detect attempts to exploit this issue.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by ensuring that the kernel does not attempt to copy the CSR to userspace if the firmware command failed, preventing buffer overflow and data leakage.
Immediate mitigation steps include:
- Update the Linux kernel to a version that includes the fix for this vulnerability.
- Avoid using or disable the affected crypto CCP driver functionality if an immediate kernel update is not possible.
- Monitor kernel logs for related errors to detect any exploitation attempts.
Applying the official patch or upgrading to a kernel version released after 2026-05-01 is the most effective way to mitigate this issue.