CVE-2026-53016

A flaw was found in the Linux kernel's cryptographic coprocessor (CCP) driver. When processing AF_ALG rfc3686-ctr-aes-ccp requests, the ccp_aes_complete() function attempts to restore more data than the allocated buffer for the Initialization Vector (IV) can hold. This leads to a buffer overrun, which can result in memory corruption within the kernel.

An out-of-bounds write exists in the AMD CCP AES completion path because ccp_aes_complete() restores AES_BLOCK_SIZE bytes into req iv even when the selected skcipher exposes a shorter IV. For RFC3686 CTR AES through AF_ALG, the caller IV can be 8 bytes while the driver copies 16 bytes, overwriting memory past the provided IV buffer. For the CVSS the PR:L is used because a local user or local process can reach AF_ALG crypto interfaces without needing full administrator privileges when the vulnerable CCP backed algorithm is available. The issue is not network reachable and requires local code execution on a system with the affected CCP crypto driver and algorithm available.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module ccp-crypto from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.