CVE-2026-31697 (GCVE-0-2026-31697)

Vulnerability from cvelistv5 – Published: 2026-05-01 13:55 – Updated: 2026-08-05 12:24
VLAI
Title
crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed When retrieving the ID for the CPU, don't attempt to copy the ID blob to userspace if the firmware command failed. If the failure was due to an invalid length, i.e. the userspace buffer+length was too small, copying the number of bytes _firmware_ requires will overflow the kernel-allocated buffer and leak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388 CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 Call Trace: <TASK> dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 copy_to_user ../include/linux/uaccess.h:236 [inline] sev_ioctl_do_get_id2+0x361/0x490 ../drivers/crypto/ccp/sev-dev.c:2222 sev_ioctl+0x25f/0x490 ../drivers/crypto/ccp/sev-dev.c:2575 vfs_ioctl ../fs/ioctl.c:51 [inline] __do_sys_ioctl ../fs/ioctl.c:597 [inline] __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> WARN if the driver says the command succeeded, but the firmware error code says otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any firwmware error.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d6112ea0cb344d6f5ed519991e24f69ba4b43d0e , < 99bae2e3c3f9ba8f854c938ed2c811b6a63b28e4 (git)
Affected: d6112ea0cb344d6f5ed519991e24f69ba4b43d0e , < a21ae9f8769e5f75433bb0a85ac3868b2100ef5b (git)
Affected: d6112ea0cb344d6f5ed519991e24f69ba4b43d0e , < 0f1f2f9894893dc8a28af1b9e9dbc0abf453eb52 (git)
Affected: d6112ea0cb344d6f5ed519991e24f69ba4b43d0e , < 09427bcb1715fb20a80b6acd5156dbf15ab5c363 (git)
Affected: d6112ea0cb344d6f5ed519991e24f69ba4b43d0e , < 1fbac0429a42adec830491757a2b53956dd797ea (git)
Affected: d6112ea0cb344d6f5ed519991e24f69ba4b43d0e , < 2937f17bbeefb8e7608ff1f78cffbeb3d0281e5e (git)
Affected: d6112ea0cb344d6f5ed519991e24f69ba4b43d0e , < 06f06d88c05ce176c61fff8c72c372847b0dd2b5 (git)
Affected: d6112ea0cb344d6f5ed519991e24f69ba4b43d0e , < 4f685dbfa87c546e51d9dc6cab379d20f275e114 (git)
Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.136 , ≤ 6.6.* (semver)
Unaffected: 6.12.84 , ≤ 6.12.* (semver)
Unaffected: 6.18.25 , ≤ 6.18.* (semver)
Unaffected: 7.0.2 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/ccp/sev-dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "99bae2e3c3f9ba8f854c938ed2c811b6a63b28e4",
              "status": "affected",
              "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
              "versionType": "git"
            },
            {
              "lessThan": "a21ae9f8769e5f75433bb0a85ac3868b2100ef5b",
              "status": "affected",
              "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
              "versionType": "git"
            },
            {
              "lessThan": "0f1f2f9894893dc8a28af1b9e9dbc0abf453eb52",
              "status": "affected",
              "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
              "versionType": "git"
            },
            {
              "lessThan": "09427bcb1715fb20a80b6acd5156dbf15ab5c363",
              "status": "affected",
              "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
              "versionType": "git"
            },
            {
              "lessThan": "1fbac0429a42adec830491757a2b53956dd797ea",
              "status": "affected",
              "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
              "versionType": "git"
            },
            {
              "lessThan": "2937f17bbeefb8e7608ff1f78cffbeb3d0281e5e",
              "status": "affected",
              "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
              "versionType": "git"
            },
            {
              "lessThan": "06f06d88c05ce176c61fff8c72c372847b0dd2b5",
              "status": "affected",
              "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
              "versionType": "git"
            },
            {
              "lessThan": "4f685dbfa87c546e51d9dc6cab379d20f275e114",
              "status": "affected",
              "version": "d6112ea0cb344d6f5ed519991e24f69ba4b43d0e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/ccp/sev-dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.84",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.25",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don\u0027t attempt to copy ID to userspace if PSP command failed\n\nWhen retrieving the ID for the CPU, don\u0027t attempt to copy the ID blob to\nuserspace if the firmware command failed.  If the failure was due to an\ninvalid length, i.e. the userspace buffer+length was too small, copying\nthe number of bytes _firmware_ requires will overflow the kernel-allocated\nbuffer and leak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388\n\n  CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_get_id2+0x361/0x490 ../drivers/crypto/ccp/sev-dev.c:2222\n   sev_ioctl+0x25f/0x490 ../drivers/crypto/ccp/sev-dev.c:2575\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   \u003c/TASK\u003e\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through a local ioctl on the host `/dev/sev` misc device using `SEV_ISSUE_CMD` with `SEV_GET_ID2`; it is not reachable from network packets or from SEV guests.\nAC:L - The attacker controls the supplied buffer length and can reliably make firmware return an invalid-length error that updates `data.len` beyond the allocated buffer size. No race or uncontrollable heap condition is required to trigger the out-of-bounds copy.\nPR:L - Access requires permission to open `/dev/sev`, which defaults restrictive but is reasonably granted to non-root virtualization users or service accounts via device policy. The ioctl command itself has no capability check and `SEV_GET_ID2` does not require write access.\nUI:N - Once the attacker has local access to the device node, exploitation is a direct ioctl call. No victim action is required.\nS:U - The vulnerability is in the host kernel SEV/PSP driver and impacts host kernel memory and availability within the same security authority. It is not a guest-to-host escape or IOMMU/DMA boundary bypass.\nC:H - The bug copies firmware-reported length bytes from a smaller `kzalloc()` buffer to userspace, leaking adjacent kernel heap memory. Under the requested high-severity tie-break rule, this out-of-bounds kernel read is High confidentiality impact.\nI:N - The flawed operation is an over-read from kernel memory during `copy_to_user()`. It does not write to kernel memory or provide a demonstrated data-modification primitive.\nA:H - The same out-of-bounds usercopy can trigger kernel hardening or sanitizer failures, and hardened usercopy aborts such invalid slab exposures with a BUG. This makes a kernel crash reasonably defensible."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:34.586Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/99bae2e3c3f9ba8f854c938ed2c811b6a63b28e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/a21ae9f8769e5f75433bb0a85ac3868b2100ef5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f1f2f9894893dc8a28af1b9e9dbc0abf453eb52"
        },
        {
          "url": "https://git.kernel.org/stable/c/09427bcb1715fb20a80b6acd5156dbf15ab5c363"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fbac0429a42adec830491757a2b53956dd797ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/2937f17bbeefb8e7608ff1f78cffbeb3d0281e5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/06f06d88c05ce176c61fff8c72c372847b0dd2b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f685dbfa87c546e51d9dc6cab379d20f275e114"
        }
      ],
      "title": "crypto: ccp: Don\u0027t attempt to copy ID to userspace if PSP command failed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31697",
    "datePublished": "2026-05-01T13:55:58.184Z",
    "dateReserved": "2026-03-09T15:48:24.131Z",
    "dateUpdated": "2026-08-05T12:24:34.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31697",
      "date": "2026-08-07",
      "epss": "0.00126",
      "percentile": "0.02639"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31697\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-01T14:16:19.517\",\"lastModified\":\"2026-06-17T10:34:15.647\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrypto: ccp: Don\u0027t attempt to copy ID to userspace if PSP command failed\\n\\nWhen retrieving the ID for the CPU, don\u0027t attempt to copy the ID blob to\\nuserspace if the firmware command failed.  If the failure was due to an\\ninvalid length, i.e. the userspace buffer+length was too small, copying\\nthe number of bytes _firmware_ requires will overflow the kernel-allocated\\nbuffer and leak data to userspace.\\n\\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\\n  Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388\\n\\n  CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\\n  Tainted: [U]=USER, [O]=OOT_MODULE\\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\\n   print_address_description ../mm/kasan/report.c:378 [inline]\\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\\n   sev_ioctl_do_get_id2+0x361/0x490 ../drivers/crypto/ccp/sev-dev.c:2222\\n   sev_ioctl+0x25f/0x490 ../drivers/crypto/ccp/sev-dev.c:2575\\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n   \u003c/TASK\u003e\\n\\nWARN if the driver says the command succeeded, but the firmware error code\\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\\nfirwmware error.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/crypto/ccp/sev-dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e\",\"lessThan\":\"99bae2e3c3f9ba8f854c938ed2c811b6a63b28e4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e\",\"lessThan\":\"a21ae9f8769e5f75433bb0a85ac3868b2100ef5b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e\",\"lessThan\":\"0f1f2f9894893dc8a28af1b9e9dbc0abf453eb52\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e\",\"lessThan\":\"09427bcb1715fb20a80b6acd5156dbf15ab5c363\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e\",\"lessThan\":\"1fbac0429a42adec830491757a2b53956dd797ea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e\",\"lessThan\":\"2937f17bbeefb8e7608ff1f78cffbeb3d0281e5e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e\",\"lessThan\":\"06f06d88c05ce176c61fff8c72c372847b0dd2b5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e\",\"lessThan\":\"4f685dbfa87c546e51d9dc6cab379d20f275e114\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/crypto/ccp/sev-dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.258\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.209\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.136\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.84\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.25\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.2\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.2\",\"versionEndExcluding\":\"6.6.136\",\"matchCriteriaId\":\"C61C6D64-BBED-49D1-A334-68BA14CE5327\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.84\",\"matchCriteriaId\":\"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.25\",\"matchCriteriaId\":\"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.2\",\"matchCriteriaId\":\"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06f06d88c05ce176c61fff8c72c372847b0dd2b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/09427bcb1715fb20a80b6acd5156dbf15ab5c363\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0f1f2f9894893dc8a28af1b9e9dbc0abf453eb52\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1fbac0429a42adec830491757a2b53956dd797ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2937f17bbeefb8e7608ff1f78cffbeb3d0281e5e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4f685dbfa87c546e51d9dc6cab379d20f275e114\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/99bae2e3c3f9ba8f854c938ed2c811b6a63b28e4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a21ae9f8769e5f75433bb0a85ac3868b2100ef5b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T12:48:14+00:00",
      "cve": "CVE-2026-31697",
      "id": "CVE-2026-31697",
      "initial_release_date": "2026-05-01T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: crypto: ccp: Don\u0027t attempt to copy ID to userspace if PSP command failed",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31697.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.