CVE-2026-31698: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31698 is a buffer overflow and kernel memory disclosure vulnerability in the Linux kernel's CCP (Cryptographic Co-Processor) crypto driver, specifically in the PDH (Platform Diffie-Hellman) certificate export functionality. The flaw affects Linux kernel versions 4.16 through 6.6.135, 6.7 through 6.12.83, 6.13 through 6.18.24, and 6.19 through 7.0.1, as well as release candidates 7.1-rc1 and 7.1-rc2. It was published on May 1, 2026, and has a CVSS v3.1 base score of 7.1 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-805 (Buffer Access with Incorrect Length Value) and CWE-787 (Out-of-bounds Write). In sev_ioctl_do_pdh_export() within drivers/crypto/ccp/sev-dev.c, when a user invokes the PDH export ioctl with a buffer smaller than the firmware requires, the PSP firmware command fails with an invalid-length error. However, the driver does not check whether the firmware command succeeded before attempting to copy data to userspace; it proceeds to copy the number of bytes the firmware reports as required, which exceeds the size of the kernel-allocated buffer, resulting in a slab-out-of-bounds read and subsequent data leak to userspace via _copy_to_user(). KASAN reports confirm a read of 2084 bytes from an out-of-bounds kernel address (Red Hat Bugzilla).

A local attacker with low privileges who can invoke the PDH export ioctl on the CCP device can leak sensitive kernel memory contents to userspace, compromising confidentiality. The out-of-bounds read can also cause kernel instability, impacting availability. Integrity is not directly affected, but leaked kernel memory may contain cryptographic material, credentials, or other sensitive data that could facilitate further privilege escalation or lateral movement (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit is currently known, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and the ability to invoke ioctl commands on the CCP/SEV device (Red Hat CVE).

1. Gain local access: Obtain a low-privilege local user account on a system running a vulnerable Linux kernel (4.16–6.6.135, 6.7–6.12.83, 6.13–6.18.24, or 6.19–7.0.1) with an AMD PSP/CCP device present.
2. Identify the CCP device: Confirm the presence of the /dev/sev or equivalent CCP device node and verify that the user has sufficient permissions to open it.
3. Craft a malformed ioctl call: Open the CCP device and invoke the SEV_PDH_CERT_EXPORT ioctl command, providing a userspace buffer and length value that is smaller than what the firmware requires for the PDH certificate.
4. Trigger the firmware error: The PSP firmware command fails due to the undersized buffer, but the driver does not check the return status before proceeding to copy data.
5. Receive leaked kernel memory: The driver copies the firmware-required number of bytes (e.g., 2084 bytes) from the kernel-allocated buffer — which is smaller than that size — into the userspace buffer, leaking adjacent kernel heap memory contents to the attacker (Red Hat Bugzilla).

• Logs: KASAN reports in kernel logs with messages such as BUG: KASAN: slab-out-of-bounds in _copy_to_user or Read of size 2084 at addr originating from sev_ioctl_do_pdh_export in drivers/crypto/ccp/sev-dev.c.
• Process: Unusual or repeated ioctl calls to /dev/sev from unprivileged processes; processes invoking SEV_PDH_CERT_EXPORT with abnormally small buffer sizes.
• Kernel: Stack traces referencing sev_ioctl_do_pdh_export+0x3d3/0x7c0 and sev_ioctl+0x2a2/0x490 in kernel crash or warning logs (Red Hat Bugzilla).

Patches are available in Linux kernel versions 6.6.136, 6.12.84, 6.18.25, and 7.0.2 and later, addressing the issue by checking the firmware command return status before any copy-to-user operation. Multiple upstream commits on kernel.org address this issue across stable branches. As a workaround, administrators should restrict access to the CCP/SEV device (/dev/sev) to trusted users only using appropriate file permissions or access control policies, and monitor for suspicious ioctl activity targeting this device (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was tracked by Red Hat's Product Security team and assigned medium severity in their Bugzilla system. The Yocto Project security mailing list discussed the CVE across multiple messages, indicating awareness in the embedded Linux community. No significant public researcher commentary or media coverage has been identified beyond standard vulnerability tracking (Red Hat Bugzilla).