CVE-2026-31697

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed When retrieving the ID for the CPU, don't attempt to copy the ID blob to userspace if the firmware command failed. If the failure was due to an invalid length, i.e. the userspace buffer+length was too small, copying the number of bytes _firmware_ requires will overflow the kernel-allocated buffer and leak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388 CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 Call Trace: <TASK> dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 copy_to_user ../include/linux/uaccess.h:236 [inline] sev_ioctl_do_get_id2+0x361/0x490 ../drivers/crypto/ccp/sev-dev.c:2222 sev_ioctl+0x25f/0x490 ../drivers/crypto/ccp/sev-dev.c:2575 vfs_ioctl ../fs/ioctl.c:51 [inline] __do_sys_ioctl ../fs/ioctl.c:597 [inline] __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> WARN if the driver says the command succeeded, but the firmware error code says otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any firwmware error.

• CWE-787

• https://git.kernel.org/stable/c/06f06d88c05ce176c61fff8c72c372847b0dd2b5Patch
• https://git.kernel.org/stable/c/09427bcb1715fb20a80b6acd5156dbf15ab5c363Patch
• https://git.kernel.org/stable/c/0f1f2f9894893dc8a28af1b9e9dbc0abf453eb52
• https://git.kernel.org/stable/c/1fbac0429a42adec830491757a2b53956dd797eaPatch
• https://git.kernel.org/stable/c/2937f17bbeefb8e7608ff1f78cffbeb3d0281e5ePatch
• https://git.kernel.org/stable/c/4f685dbfa87c546e51d9dc6cab379d20f275e114Patch
• https://git.kernel.org/stable/c/99bae2e3c3f9ba8f854c938ed2c811b6a63b28e4
• https://git.kernel.org/stable/c/a21ae9f8769e5f75433bb0a85ac3868b2100ef5b

Published

May 1, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31691In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-31692In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-31693In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-31694In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-31695In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-31696In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-31698In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-31699In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-3170A vulnerability was detected in SourceCodester/Patrick Mvuma…4.8
• CVE-2026-31700In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-31701In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-31702In the Linux kernel, the following vulnerability has been re…7.8