CVE-2026-31697
kernel: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · May 1, 2026
Updated · July 2, 2026
Description
A flaw was found in the Linux kernel's crypto: ccp driver. A local user could exploit this vulnerability by attempting to retrieve the CPU ID when a firmware command fails due to an invalid length. This can cause an overflow of a kernel-allocated buffer, leading to the disclosure of sensitive kernel memory to userspace.
Statement
When AMD PSP/CCP firmware commands fail, the kernel must not copy uninitialized ID buffers to userspace. Red Hat treats this as a local information-disclosure hardening issue on systems using the CCP crypto driver. Apply patched kernels.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-805 · Buffer Access with Incorrect Length Value