CVE-2026-74404

Received Received - Intake

Heap Buffer Overflow in Linux Kernel Crypto CCP

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one Sashiko notes: > regarding the bounds check in snp_filter_reserved_mem_regions() > called via walk_iomem_res_desc(): does the check > if ((range_list->num_elements * 16 + 8) > PAGE_SIZE) > allow an off-by-one heap buffer overflow? > > If range_list->num_elements is 255, 255 * 16 + 8 = 4088, which is <= 4096. > Writing range->base (8 bytes) fills 4088-4095, but writing range->page_count > (4 bytes) would write to 4096-4099, overflowing the kzalloc-allocated > PAGE_SIZE buffer. Fix this by accounting for the entry about to be written to, in addition to the entries that are already allocated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74404

EUVD

EUVD-2026-59551

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a heap buffer overflow vulnerability in the Linux kernel's crypto subsystem, specifically in the AMD Secure Nested Paging (SNP) driver (ccp). The issue occurs in the snp_filter_reserved_mem_regions() function when processing memory range entries. A miscalculation in buffer size allows writing beyond the allocated memory when handling 255 entries, potentially corrupting adjacent memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's crypto subsystem, particularly the CCP (Cryptographic Coprocessor) driver. Detection requires checking the kernel version and examining the affected function snp_filter_reserved_mem_regions(). Use commands like uname -a to check kernel version and grep to search for the vulnerable code in the kernel source.

Impact Analysis

This vulnerability could allow local attackers to escalate privileges, execute arbitrary code, or cause system crashes by triggering the buffer overflow. Systems using affected Linux kernel versions with AMD SNP hardware may be vulnerable to memory corruption attacks.

Compliance Impact

This vulnerability is a heap buffer overflow in the Linux kernel's crypto subsystem, specifically in the AMD Secure Nested Paging (SNP) filter reserved memory regions. It does not directly relate to data protection or privacy compliance standards like GDPR or HIPAA, as it is a low-level memory corruption issue in a cryptographic driver.

Mitigation Strategies

Apply the latest kernel patch from your Linux distribution to fix the off-by-one error in snp_filter_reserved_mem_regions(). If patching is not immediately possible, consider disabling the CCP driver module (ccp) if it is not required for your system's operations.

Hi! I’m here to help you understand CVE-2026-74404. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70