CVE-2026-74404

A flaw was found in the Linux kernel's crypto: ccp component. An off-by-one error in the snp_filter_reserved_mem_regions() function can lead to a heap buffer overflow. This vulnerability could allow an attacker to corrupt memory, potentially leading to a denial of service or arbitrary code execution.

An off by one bounds check in snp_filter_reserved_mem_regions can allow a page sized kzalloc buffer to be overrun when the reserved memory range list reaches the boundary case. The function checks the size of entries already present but does not account for the next sev_data_range entry before writing it, so the page_count field can be written past PAGE_SIZE. This is a kernel heap out of bounds write during AMD SEV SNP initialization rather than a pure warning or resource leak. For the CVSS the PR:H is used because reliable triggering normally requires administrative or platform level control over the reserved memory layout or driver initialization path. The issue is not directly network reachable. Impact is at least denial of service via kernel memory corruption and in the paranoid case may include confidentiality or integrity impact if the overflow corrupts a sensitive adjacent heap object.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.