CVE-2026-31698

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31698", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.131Z", "datePublished": "2026-05-01T13:55:58.854Z", "dateUpdated": "2026-10-19T19:06:06.375Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:35.659Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed\n\nWhen retrieving the PDH cert, don't attempt to copy the blobs to userspace\nif the firmware command failed. If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n Read of size 2084 at addr ffff8885c4ab8aa0 by task syz.0.186/21033\n\n CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY\n Tainted: [U]=USER, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025\n Call Trace:\n <TASK>\n dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n print_address_description ../mm/kasan/report.c:378 [inline]\n print_report+0xbc/0x260 ../mm/kasan/report.c:482\n kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n check_region_inline ../mm/kasan/generic.c:-1 [inline]\n kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n copy_to_user ../include/linux/uaccess.h:236 [inline]\n sev_ioctl_do_pdh_export+0x3d3/0x7c0 ../drivers/crypto/ccp/sev-dev.c:2347\n sev_ioctl+0x2a2/0x490 ../drivers/crypto/ccp/sev-dev.c:2568\n vfs_ioctl ../fs/ioctl.c:51 [inline]\n __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n </TASK>\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through the local `/dev/sev` misc device via the `SEV_ISSUE_CMD` ioctl and `SEV_PDH_CERT_EXPORT` command, not by network or adjacent packets.\nAC:L - An attacker who can access `/dev/sev` can supply undersized nonzero certificate buffers and reliably make firmware return the required larger lengths; no race or hard-to-influence condition is required.\nPR:L - The kernel path has no capability check, and although `/dev/sev` is often root-restricted by default, SEV-capable hosts commonly delegate access to non-root virtualization users or groups; using the higher-severity reasonable case makes this low privileges.\nUI:N - No victim action is required after the attacker has local access to the device; the ioctl directly triggers the vulnerable path.\nS:U - The bug leaks or crashes kernel memory in the same host kernel security authority; it is not a VM escape or other cross-scope boundary violation by itself.\nC:H - The failed firmware command overwrites the returned lengths with larger required sizes, and the vulnerable code copies that many bytes from smaller kernel heap buffers to userspace, producing an out-of-bounds kernel memory disclosure.\nI:N - The bug is an out-of-bounds read during `copy_to_user`, with no direct write, memory corruption, or control-flow modification primitive.\nA:H - The same out-of-bounds usercopy is reported as a KASAN slab-out-of-bounds read and can also trip hardened usercopy BUG/oops paths on hardened kernels, making a kernel crash a defensible impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/crypto/ccp/sev-dev.c"], "versions": [{"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "af67d35da744b6b678c7a0296d9c679658779829", "status": "affected", "versionType": "git"}, {"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "854d7846e1d29f32f1bbeb2e869e794df12067f6", "status": "affected", "versionType": "git"}, {"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "25d9b3446001185484209cf57951f3368462b631", "status": "affected", "versionType": "git"}, {"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "b5c14bd4da1f376f385722fe1da993f1edab6472", "status": "affected", "versionType": "git"}, {"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "78b97e43d0b3e674d9d49ae56937b11e2ba3fcaf", "status": "affected", "versionType": "git"}, {"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "051e51aa55fd4cdc3e8283cf4476aeeb5f563274", "status": "affected", "versionType": "git"}, {"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "50808c13452dae43a2c90b1bbbf9daa16501ce70", "status": "affected", "versionType": "git"}, {"version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "e76239fed3cffd6d304d8ca3ce23984fd24f57d3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/crypto/ccp/sev-dev.c"], "versions": [{"version": "4.16", "status": "affected"}, {"version": "0", "lessThan": "4.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.84", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.25", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.2", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.12.84"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.18.25"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "7.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/af67d35da744b6b678c7a0296d9c679658779829"}, {"url": "https://git.kernel.org/stable/c/854d7846e1d29f32f1bbeb2e869e794df12067f6"}, {"url": "https://git.kernel.org/stable/c/25d9b3446001185484209cf57951f3368462b631"}, {"url": "https://git.kernel.org/stable/c/b5c14bd4da1f376f385722fe1da993f1edab6472"}, {"url": "https://git.kernel.org/stable/c/78b97e43d0b3e674d9d49ae56937b11e2ba3fcaf"}, {"url": "https://git.kernel.org/stable/c/051e51aa55fd4cdc3e8283cf4476aeeb5f563274"}, {"url": "https://git.kernel.org/stable/c/50808c13452dae43a2c90b1bbbf9daa16501ce70"}, {"url": "https://git.kernel.org/stable/c/e76239fed3cffd6d304d8ca3ce23984fd24f57d3"}], "title": "crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:57.426Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31698", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:12:37.237347Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:06:06.375Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:57.426Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31698", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:12:37.237347Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:12:37.790Z"}}], "cna": {"title": "crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through the local `/dev/sev` misc device via the `SEV_ISSUE_CMD` ioctl and `SEV_PDH_CERT_EXPORT` command, not by network or adjacent packets.\nAC:L - An attacker who can access `/dev/sev` can supply undersized nonzero certificate buffers and reliably make firmware return the required larger lengths; no race or hard-to-influence condition is required.\nPR:L - The kernel path has no capability check, and although `/dev/sev` is often root-restricted by default, SEV-capable hosts commonly delegate access to non-root virtualization users or groups; using the higher-severity reasonable case makes this low privileges.\nUI:N - No victim action is required after the attacker has local access to the device; the ioctl directly triggers the vulnerable path.\nS:U - The bug leaks or crashes kernel memory in the same host kernel security authority; it is not a VM escape or other cross-scope boundary violation by itself.\nC:H - The failed firmware command overwrites the returned lengths with larger required sizes, and the vulnerable code copies that many bytes from smaller kernel heap buffers to userspace, producing an out-of-bounds kernel memory disclosure.\nI:N - The bug is an out-of-bounds read during `copy_to_user`, with no direct write, memory corruption, or control-flow modification primitive.\nA:H - The same out-of-bounds usercopy is reported as a KASAN slab-out-of-bounds read and can also trip hardened usercopy BUG/oops paths on hardened kernels, making a kernel crash a defensible impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "af67d35da744b6b678c7a0296d9c679658779829", "versionType": "git"}, {"status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "854d7846e1d29f32f1bbeb2e869e794df12067f6", "versionType": "git"}, {"status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "25d9b3446001185484209cf57951f3368462b631", "versionType": "git"}, {"status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "b5c14bd4da1f376f385722fe1da993f1edab6472", "versionType": "git"}, {"status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "78b97e43d0b3e674d9d49ae56937b11e2ba3fcaf", "versionType": "git"}, {"status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "051e51aa55fd4cdc3e8283cf4476aeeb5f563274", "versionType": "git"}, {"status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "50808c13452dae43a2c90b1bbbf9daa16501ce70", "versionType": "git"}, {"status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "lessThan": "e76239fed3cffd6d304d8ca3ce23984fd24f57d3", "versionType": "git"}], "programFiles": ["drivers/crypto/ccp/sev-dev.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.16"}, {"status": "unaffected", "version": "0", "lessThan": "4.16", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.136", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.84", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.25", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.2", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/crypto/ccp/sev-dev.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/af67d35da744b6b678c7a0296d9c679658779829"}, {"url": "https://git.kernel.org/stable/c/854d7846e1d29f32f1bbeb2e869e794df12067f6"}, {"url": "https://git.kernel.org/stable/c/25d9b3446001185484209cf57951f3368462b631"}, {"url": "https://git.kernel.org/stable/c/b5c14bd4da1f376f385722fe1da993f1edab6472"}, {"url": "https://git.kernel.org/stable/c/78b97e43d0b3e674d9d49ae56937b11e2ba3fcaf"}, {"url": "https://git.kernel.org/stable/c/051e51aa55fd4cdc3e8283cf4476aeeb5f563274"}, {"url": "https://git.kernel.org/stable/c/50808c13452dae43a2c90b1bbbf9daa16501ce70"}, {"url": "https://git.kernel.org/stable/c/e76239fed3cffd6d304d8ca3ce23984fd24f57d3"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed\n\nWhen retrieving the PDH cert, don't attempt to copy the blobs to userspace\nif the firmware command failed. If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n Read of size 2084 at addr ffff8885c4ab8aa0 by task syz.0.186/21033\n\n CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY\n Tainted: [U]=USER, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025\n Call Trace:\n <TASK>\n dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n print_address_description ../mm/kasan/report.c:378 [inline]\n print_report+0xbc/0x260 ../mm/kasan/report.c:482\n kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n check_region_inline ../mm/kasan/generic.c:-1 [inline]\n kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n copy_to_user ../include/linux/uaccess.h:236 [inline]\n sev_ioctl_do_pdh_export+0x3d3/0x7c0 ../drivers/crypto/ccp/sev-dev.c:2347\n sev_ioctl+0x2a2/0x490 ../drivers/crypto/ccp/sev-dev.c:2568\n vfs_ioctl ../fs/ioctl.c:51 [inline]\n __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n </TASK>\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.258", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.209", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.136", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.84", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.25", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.2", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "4.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:35.659Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31698", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:06:06.375Z", "dateReserved": "2026-03-09T15:48:24.131Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-01T13:55:58.854Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/crypto/ccp/sev-dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "af67d35da744b6b678c7a0296d9c679658779829", "status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "versionType": "git"}, {"lessThan": "854d7846e1d29f32f1bbeb2e869e794df12067f6", "status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "versionType": "git"}, {"lessThan": "25d9b3446001185484209cf57951f3368462b631", "status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "versionType": "git"}, {"lessThan": "b5c14bd4da1f376f385722fe1da993f1edab6472", "status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "versionType": "git"}, {"lessThan": "78b97e43d0b3e674d9d49ae56937b11e2ba3fcaf", "status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "versionType": "git"}, {"lessThan": "051e51aa55fd4cdc3e8283cf4476aeeb5f563274", "status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "versionType": "git"}, {"lessThan": "50808c13452dae43a2c90b1bbbf9daa16501ce70", "status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "versionType": "git"}, {"lessThan": "e76239fed3cffd6d304d8ca3ce23984fd24f57d3", "status": "affected", "version": "76a2b524a4b1d6dc0f2421f9854a01d55d5e5436", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/crypto/ccp/sev-dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.16"}, {"lessThan": "4.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.84", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.25", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A32447F-A6C2-4D97-8B3B-EB4280574173", "versionEndExcluding": "6.6.136", "versionStartIncluding": "4.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7", "versionEndExcluding": "6.12.84", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C", "versionEndExcluding": "6.18.25", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8", "versionEndExcluding": "7.0.2", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed\n\nWhen retrieving the PDH cert, don't attempt to copy the blobs to userspace\nif the firmware command failed. If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n Read of size 2084 at addr ffff8885c4ab8aa0 by task syz.0.186/21033\n\n CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY\n Tainted: [U]=USER, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025\n Call Trace:\n <TASK>\n dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n print_address_description ../mm/kasan/report.c:378 [inline]\n print_report+0xbc/0x260 ../mm/kasan/report.c:482\n kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n check_region_inline ../mm/kasan/generic.c:-1 [inline]\n kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n copy_to_user ../include/linux/uaccess.h:236 [inline]\n sev_ioctl_do_pdh_export+0x3d3/0x7c0 ../drivers/crypto/ccp/sev-dev.c:2347\n sev_ioctl+0x2a2/0x490 ../drivers/crypto/ccp/sev-dev.c:2568\n vfs_ioctl ../fs/ioctl.c:51 [inline]\n __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n </TASK>\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: ccp: No intente copiar el certificado PDH al espacio de usuario si el comando PSP fall\u00f3\n\nAl recuperar el certificado PDH, no intente copiar los blobs al espacio de usuario si el comando del firmware fall\u00f3. Si el fallo se debi\u00f3 a una longitud no v\u00e1lida, es decir, el b\u00fafer+longitud del espacio de usuario era demasiado peque\u00f1o, copiar el n\u00famero de bytes que el _firmware_ requiere desbordar\u00e1 el b\u00fafer asignado por el kernel y filtrar\u00e1 datos al espacio de usuario.\n\n BUG: KASAN: slab-out-of-bounds en instrument_copy_to_user .. / include/linux/instrumented.h:129 [inline]\n BUG: KASAN: slab-out-of-bounds en _inline_copy_to_user .. / include/linux/uaccess.h:205 [inline]\n BUG: KASAN: slab-out-of-bounds en _copy_to_user+0x66/0xa0 .. / lib/usercopy.c:26\n Lectura de tama\u00f1o 2084 en la direcci\u00f3n ffff8885c4ab8aa0 por la tarea syz.0.186/21033\n\n CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY\n Tainted: [U]=USER, [O]=OOT_MODULE\n Nombre del hardware: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025\n Traza de llamadas:\n [TAREA]\n dump_stack_lvl+0xc5/0x110 .. / lib/dump_stack.c:120\n print_address_description .. / mm/kasan/report.c:378 [inline]\n print_report+0xbc/0x260 .. / mm/kasan/report.c:482\n kasan_report+0xa2/0xe0 .. / mm/kasan/report.c:595\n check_region_inline .. / mm/kasan/generic.c:-1 [inline]\n kasan_check_range+0x264/0x2c0 .. / mm/kasan/generic.c:200\n instrument_copy_to_user .. / include/linux/instrumented.h:129 [inline]\n _inline_copy_to_user .. / include/linux/uaccess.h:205 [inline]\n _copy_to_user+0x66/0xa0 .. / lib/usercopy.c:26\n copy_to_user .. / include/linux/uaccess.h:236 [inline]\n sev_ioctl_do_pdh_export+0x3d3/0x7c0 .. / drivers/crypto/ccp/sev-dev.c:2347\n sev_ioctl+0x2a2/0x490 .. / drivers/crypto/ccp/sev-dev.c:2568\n vfs_ioctl .. / fs/ioctl.c:51 [inline]\n __do_sys_ioctl .. / fs/ioctl.c:597 [inline]\n __se_sys_ioctl+0x11d/0x1b0 .. / fs/ioctl.c:583\n do_syscall_x64 .. / arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xe0/0x800 .. / arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n [/TAREA]\n\nADVERTENCIA si el controlador dice que el comando tuvo \u00e9xito, pero el c\u00f3digo de error del firmware dice lo contrario, ya que se espera que __sev_do_cmd_locked() devuelva -EIO ante cualquier error del firmware."}], "id": "CVE-2026-31698", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31698", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:12:37.237347Z", "version": "2.0.3"}}]}, "published": "2026-05-01T14:16:19.650", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/051e51aa55fd4cdc3e8283cf4476aeeb5f563274"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/25d9b3446001185484209cf57951f3368462b631"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/50808c13452dae43a2c90b1bbbf9daa16501ce70"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/78b97e43d0b3e674d9d49ae56937b11e2ba3fcaf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/854d7846e1d29f32f1bbeb2e869e794df12067f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af67d35da744b6b678c7a0296d9c679658779829"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b5c14bd4da1f376f385722fe1da993f1edab6472"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e76239fed3cffd6d304d8ca3ce23984fd24f57d3"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed", "id": "2464415", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464415"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["A flaw was found in the Linux kernel's crypto subsystem, specifically within the ccp driver. A local user could exploit this vulnerability when attempting to retrieve the Platform DH (PDH) certificate. If a firmware command fails due to an invalid length, the driver may attempt to copy data to userspace, leading to a kernel-allocated buffer overflow. This issue can result in the disclosure of sensitive information to the local user."], "name": "CVE-2026-31698", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31698\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31698\nhttps://lore.kernel.org/linux-cve-announce/2026050118-CVE-2026-31698-c4df@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[76a2b524a4b1d6dc0f2421f9854a01d55d5e5436,b5c14bd4da1f376f385722fe1da993f1edab6472)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[76a2b524a4b1d6dc0f2421f9854a01d55d5e5436,78b97e43d0b3e674d9d49ae56937b11e2ba3fcaf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[76a2b524a4b1d6dc0f2421f9854a01d55d5e5436,051e51aa55fd4cdc3e8283cf4476aeeb5f563274)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[76a2b524a4b1d6dc0f2421f9854a01d55d5e5436,50808c13452dae43a2c90b1bbbf9daa16501ce70)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[76a2b524a4b1d6dc0f2421f9854a01d55d5e5436,e76239fed3cffd6d304d8ca3ce23984fd24f57d3)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.136,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.84,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.25,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.2,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T21:45:09.326977+00:00", "updated": "2026-10-23T08:45:16.398906+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}