CVE-2026-80652

A flaw was found in the Linux kernel's Cryptographic Co-processor (CCP) driver. A local attacker could trigger a kernel crash, leading to a denial of service (DoS), by providing a zero-length certificate chain buffer during a Platform Dynamic Hardware (PDH) export operation. This issue specifically affects systems where the CONFIG_DEBUG_VIRTUAL kernel configuration option is enabled.

A low impact flaw was found in the Linux kernel's Cryptographic Co-processor (CCP) driver in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt) and RHIVOS 2. When handling a PDH export through the SEV ioctl interface, a zero-length userspace certificate-chain buffer is not treated as a request to query the relevant blob lengths, so the driver attempts to compute the physical address of the ZERO_SIZE_PTR returned by kzalloc(). On kernels built with CONFIG_DEBUG_VIRTUAL=y this trips a BUG_ON() and crashes the kernel, allowing a local attacker to cause a denial of service. Outside of CONFIG_DEBUG_VIRTUAL=y the bug is benign, because computing the physical address is only arithmetic and the PSP errors out before writing to the invalid address. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those streams. Because a crash requires local access to a system with the affected SEV device and a debug kernel configuration that is not used in production builds, the flaw is assessed as low impact despite the moderate CVSS base score, and the fix is deferred to a future update; the residual risk is limited to a local denial of service on debug configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.