CVE-2026-80652
Received Received - Intake

Kernel BUG in AMD CCP SEV PDH Export Handling

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the zero-length buffer trips a BUG_ON() when running with CONFIG_DEBUG_VIRTUAL=y due to trying to get the physical address of the ZERO_SIZE_PTR (returned by kzalloc() on the bogus allocation). kernel BUG at arch/x86/mm/physaddr.c:28 ! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 30 UID: 0 PID: 28580 Comm: syz.2.18 Kdump: loaded Tainted: G W 6.18.16-smp-DEV #1 NONE Tainted: [W]=WARN Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 RIP: 0010:__phys_addr+0x16a/0x180 arch/x86/mm/physaddr.c:28 RSP: 0018:ffffc9008329fc80 EFLAGS: 00010293 RAX: ffffffff8179110a RBX: 0000778000000010 RCX: ffff8884e6992600 RDX: 0000000000000000 RSI: 0000000080000010 RDI: 0000778000000010 RBP: ffffc9008329fdf0 R08: 0000000000000dc0 R09: 00000000ffffffff R10: dffffc0000000000 R11: fffffbfff126d297 R12: dffffc0000000000 R13: 1ffff92010653fc8 R14: 0000000080000010 R15: dffffc0000000000 FS: 0000555556bec9c0(0000) GS:ffff88aa4ce1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd3159e7000 CR3: 00000004fbc44000 CR4: 0000000000350ef0 Call Trace: <TASK> [<ffffffff853d3869>] sev_ioctl_do_pdh_export+0x559/0x7a0 drivers/crypto/ccp/sev-dev.c:2308 [<ffffffff853d1fdd>] sev_ioctl+0x2cd/0x480 drivers/crypto/ccp/sev-dev.c:2556 [<ffffffff82549ebc>] vfs_ioctl fs/ioctl.c:52 [inline] [<ffffffff82549ebc>] __do_sys_ioctl fs/ioctl.c:598 [inline] [<ffffffff82549ebc>] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584 [<ffffffff8630115f>] do_syscall_x64 arch/x86/entry/syscall_64.c:64 [inline] [<ffffffff8630115f>] do_syscall_64+0x9f/0xf40 arch/x86/entry/syscall_64.c:98 [<ffffffff81000136>] entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fd3158eac39 </TASK> Thankfully, the bug is benign outside of CONFIG_DEBUG_VIRTUAL=y as getting the physical address is just arithmetic, and the PSP errors out before trying to write to the garbage address (which it must, otherwise querying the blob lengths would clobber memory at pfn=0).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-80652
EUVD
EUVD-2026-67528

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel 6.18.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's crypto subsystem (CCP) occurs when handling a PDH export with a zero-length userspace cert chain buffer. The kernel fails to properly handle this case, leading to a BUG_ON() trigger when CONFIG_DEBUG_VIRTUAL is enabled. This happens because the code tries to get the physical address of a ZERO_SIZE_PTR, causing a kernel oops.

Detection Guidance

This vulnerability is specific to the Linux kernel's CCP (Cryptographic Coprocessor) driver and triggers a kernel BUG_ON() when handling zero-length cert chain buffers with CONFIG_DEBUG_VIRTUAL=y enabled. Detection requires checking kernel logs for BUG_ON() errors related to physaddr.c or sev_ioctl_do_pdh_export. Monitor system logs for crashes or oops messages involving these components.

Impact Analysis

The impact is limited. The bug only triggers a kernel warning when running with CONFIG_DEBUG_VIRTUAL=y. Outside this configuration, the issue is benign as the physical address calculation is just arithmetic. The PSP (Platform Security Processor) errors out before writing to invalid memory, preventing memory corruption.

Compliance Impact

This vulnerability is specific to the Linux kernel's crypto subsystem and does not directly impact compliance with GDPR or HIPAA. It is a low-level kernel bug that could cause system instability under specific debug configurations but does not involve data exposure or unauthorized access.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. If CONFIG_DEBUG_VIRTUAL=y is enabled, consider disabling it temporarily until patched. Avoid triggering PDH export operations with zero-length cert chains. Monitor kernel logs for related errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80652. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart