CVE-2026-74403
Received Received - Intake

Null pointer dereference in Linux kernel CCP driver

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: > if __snp_alloc_firmware_pages() returns NULL under memory pressure, is it > safe to pass it directly to page_address()? > > On architectures without HASHED_PAGE_VIRTUAL, page_address(NULL) might > compute a deterministic but invalid, non-zero virtual address. The > subsequent if (tio_status) check would then evaluate to true, and > sev_tsm_init_locked() would dereference the invalid pointer. Indeed, page_address(NULL) will return non-NULL garbage here. Fix this by checking the page allocation itself for NULL, not the resulting virtual address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74403
EUVD
EUVD-2026-59550

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's crypto subsystem, specifically in the CCP (AMD Cryptographic Coprocessor) driver. It involves improper handling of memory allocation failures when initializing firmware pages. If memory allocation fails, the code incorrectly passes a NULL pointer to page_address(), which may return a non-NULL but invalid virtual address on some architectures. This leads to a potential invalid pointer dereference in sev_tsm_init_locked().

Detection Guidance

This vulnerability is specific to the Linux kernel's crypto subsystem, particularly in the CCP (AMD Cryptographic Coprocessor) driver. Detection would require checking kernel logs for errors related to page allocation failures in the TIO (TrustZone Interface) or CCP components. Commands like dmesg | grep -i ccp or journalctl -k | grep -i ccp may help identify issues.

Impact Analysis

This vulnerability could cause system instability or crashes if exploited. It may allow local attackers to trigger kernel memory corruption, leading to denial-of-service conditions or privilege escalation. Systems using AMD SEV (Secure Encrypted Virtualization) features are particularly affected.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to ensure the fix for this vulnerability is included. Monitor kernel logs for related errors and consider temporarily disabling the CCP driver if the issue persists until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74403. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart