CVE-2022-50226: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50226 is a vulnerability discovered in the Linux kernel's crypto: ccp component, specifically affecting the sev ioctl interfaces. The vulnerability was reported through kernel.org and published on June 18, 2025. The issue involves memory allocation handling where input may be passed that is less than or equal to SEVFWBLOBMAXSIZE but larger than the data that PSP firmware returns (NVD, Wiz).

The vulnerability occurs when kmalloc allocates memory that is the size of the input rather than the size of the data returned by PSP firmware. Since PSP firmware doesn't fully overwrite the buffer, the sev ioctl interfaces with this issue may return uninitialized slab memory. While all ioctl interfaces in the ccp driver were reported to be safe at the time, the issue presented a potential security risk for future implementations (NVD).

The vulnerability could result in information disclosure through uninitialized kernel memory being exposed to userspace applications (Wiz).

The vulnerability was addressed by changing all ioctl interfaces that allocate memory with kmalloc to use kzalloc instead. Additionally, the fix includes adding memset to zero the data buffer in sevioctldoplatformstatus to prevent future problems (Wiz).