CVE-2026-31697: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31697 is a buffer overflow vulnerability in the Linux kernel's CCP (Cryptographic Coprocessor) crypto driver, specifically in the sev_ioctl_do_get_id2 function within drivers/crypto/ccp/sev-dev.c. When a PSP (Platform Security Processor) firmware command fails due to an undersized userspace buffer, the driver incorrectly attempts to copy the number of bytes the firmware requires — rather than the allocated buffer size — to userspace, causing a slab-out-of-bounds read and leaking kernel memory. Affected Linux kernel versions include 5.2 through 6.6.136, 6.7 through 6.12.84, 6.13 through 6.18.25, 6.19 through 7.0.2, and release candidates 7.1-rc1 and 7.1-rc2. The vulnerability was published on May 1, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-805 (Buffer Access with Incorrect Length Value) and CWE-787 (Out-of-bounds Write). In sev_ioctl_do_get_id2, when the firmware returns an error indicating the provided buffer length is insufficient, the driver fails to abort the copy operation and instead uses the firmware-reported required length — which exceeds the kernel-allocated buffer — to copy data to userspace via _copy_to_user. This results in a KASAN-detected slab-out-of-bounds read of up to 64 bytes beyond the allocated buffer. Exploitation requires a local attacker with low privileges to issue a crafted ioctl call to the SEV device (/dev/sev) with a deliberately undersized buffer, triggering the erroneous copy path (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows a local unprivileged attacker to read sensitive kernel memory contents that are leaked to userspace, posing a high confidentiality risk. The out-of-bounds read can also contribute to system instability or kernel panics, resulting in a high availability impact. While integrity is not directly affected, the leaked kernel data (e.g., pointers, cryptographic material) could be leveraged as part of a multi-stage exploit chain to achieve privilege escalation on systems running AMD EPYC processors with SEV support (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a low probability of exploitation in the near term. Exploitation is constrained to local access with low privileges on systems where the CCP crypto driver is loaded and the /dev/sev device is accessible.

1. Reconnaissance: Identify a target system running a vulnerable Linux kernel version (5.2–6.6.136, 6.7–6.12.84, 6.13–6.18.25, or 6.19–7.0.2) with an AMD EPYC processor and the CCP crypto driver loaded. Confirm the presence of /dev/sev and that the attacker has at least low-privilege local access.
2. Open the SEV device: Open a file descriptor to /dev/sev using standard system calls (e.g., open("/dev/sev", O_RDWR)).
3. Craft a malformed ioctl request: Prepare a SEV_GET_ID2 ioctl request structure with a userspace buffer whose length is intentionally set smaller than what the firmware requires for the CPU ID blob.
4. Issue the ioctl call: Call ioctl(fd, SEV_GET_ID2, &request) with the undersized buffer. The firmware command will fail with an invalid-length error, but the vulnerable driver will proceed to copy the firmware-required number of bytes (larger than the allocated kernel buffer) to userspace.
5. Read leaked kernel memory: The _copy_to_user operation reads beyond the kernel-allocated buffer boundary, leaking adjacent kernel heap memory (up to 64 bytes observed in KASAN reports) into the attacker-controlled userspace buffer.
6. Leverage leaked data: Analyze the leaked kernel memory for sensitive data such as kernel pointers, cryptographic keys, or other heap contents that could be used to defeat KASLR or facilitate further privilege escalation (Red Hat Bugzilla).

• Logs: KASAN kernel log messages containing BUG: KASAN: slab-out-of-bounds in _copy_to_user or instrument_copy_to_user originating from sev-dev.c; kernel warnings referencing sev_ioctl_do_get_id2 in the call trace.
• Process: Unusual or repeated ioctl calls to /dev/sev from unprivileged or unexpected processes; processes such as fuzzing tools (e.g., syzkaller-style processes) making high-frequency SEV ioctl calls.
• File System: Unexpected access to /dev/sev by non-administrative users or processes not associated with legitimate SEV management tools.
• Network: No direct network indicators; however, post-exploitation lateral movement may manifest as unexpected outbound connections from the compromised host (Red Hat Bugzilla).

Apply the upstream kernel patches available via the stable kernel tree (commits 06f06d88, 09427bcb, 1fbac042, 2937f17b, 4f685dbf) targeting fixed versions including 6.6.136+, 6.12.84+, 6.18.25+, and 7.0.2+ (Red Hat CVE, Red Hat Bugzilla). As a workaround, restrict access to /dev/sev to trusted processes only using appropriate file permissions or SELinux/AppArmor policies. If SEV functionality is not required, consider disabling the CCP crypto driver (CONFIG_CRYPTO_DEV_CCP) to eliminate the attack surface entirely. Prioritize patching on systems running AMD EPYC processors with SEV support enabled.

The vulnerability was reported to Red Hat's Security Response team via OSIDB automated import and tracked in Red Hat Bugzilla (Bug 2464427). The upstream kernel advisory was published via the linux-cve-announce mailing list. The Yocto Project security team also tracked and communicated the CVE across multiple security digest messages to their community (Red Hat Bugzilla). No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking channels.