CVE-2026-31699

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31699", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.131Z", "datePublished": "2026-05-01T13:55:59.520Z", "dateUpdated": "2026-10-19T19:06:06.521Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:36.729Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed\n\nWhen retrieving the PEK CSR, don't attempt to copy the blob to userspace\nif the firmware command failed. If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n Read of size 2084 at addr ffff898144612e20 by task syz.9.219/21405\n\n CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY\n Tainted: [U]=USER, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n Call Trace:\n <TASK>\n dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n print_address_description ../mm/kasan/report.c:378 [inline]\n print_report+0xbc/0x260 ../mm/kasan/report.c:482\n kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n check_region_inline ../mm/kasan/generic.c:-1 [inline]\n kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n copy_to_user ../include/linux/uaccess.h:236 [inline]\n sev_ioctl_do_pek_csr+0x31f/0x590 ../drivers/crypto/ccp/sev-dev.c:1872\n sev_ioctl+0x3a4/0x490 ../drivers/crypto/ccp/sev-dev.c:2562\n vfs_ioctl ../fs/ioctl.c:51 [inline]\n __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n </TASK>\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through a local `ioctl(SEV_ISSUE_CMD)` on the `/dev/sev` misc character device with the `SEV_PEK_CSR` subcommand, not through a network or adjacent interface.\nAC:L - An attacker who can issue the ioctl can reliably trigger the bug by providing a CSR buffer length that is too small, causing firmware to return the required larger length. No race or condition outside the attacker's control is required.\nPR:L - The path requires write access to `/dev/sev`; the driver does not enforce a capability check, and reasonable SEV management deployments may delegate writable device access to non-root service or management accounts. Under the required higher-severity rule, this is scored as low privileges rather than root-only.\nUI:N - The attacker directly opens the device and issues the ioctl. No separate victim action is required.\nS:U - The bug affects kernel memory from a local kernel device interface within the same host security scope. It is not a VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The old code copied the firmware-reported required CSR length from a smaller `kzalloc()` buffer, producing a slab out-of-bounds read into userspace. This can leak adjacent kernel heap data and is not limited to only a few bytes.\nI:N - The vulnerability is an out-of-bounds read during `copy_to_user()`, with no kernel memory write or direct control-flow corruption. It does not directly provide an integrity impact.\nA:H - The out-of-bounds usercopy is shown to trigger a KASAN slab-out-of-bounds BUG, and hardened/debug configurations can turn the invalid exposure into an oops or panic. It can be triggered repeatedly by issuing the ioctl again."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/crypto/ccp/sev-dev.c"], "versions": [{"version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "502d10a1d9d477e6c7fc7021a2dac7018f4ab8b5", "status": "affected", "versionType": "git"}, {"version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "0fb87e44b81385f940b482cba5b3f0bd18fb8185", "status": "affected", "versionType": "git"}, {"version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "372116eece159adff631b1508344c8b85ebf9559", "status": "affected", "versionType": "git"}, {"version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "607ba280f2adb5092cf5386c3935afac2ca0031a", "status": "affected", "versionType": "git"}, {"version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "59e9ae81f8670ccc780bc75f45a355736f640ec9", "status": "affected", "versionType": "git"}, {"version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "111dcc6d0f016076745824a787d25609d0022f4c", "status": "affected", "versionType": "git"}, {"version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "3b4fd8f15765d9a3105b834dba8a05d025e5e16e", "status": "affected", "versionType": "git"}, {"version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "abe4a6d6f606113251868c2c4a06ba904bb41eed", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/crypto/ccp/sev-dev.c"], "versions": [{"version": "4.16", "status": "affected"}, {"version": "0", "lessThan": "4.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.84", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.25", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.2", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.12.84"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.18.25"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "7.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/502d10a1d9d477e6c7fc7021a2dac7018f4ab8b5"}, {"url": "https://git.kernel.org/stable/c/0fb87e44b81385f940b482cba5b3f0bd18fb8185"}, {"url": "https://git.kernel.org/stable/c/372116eece159adff631b1508344c8b85ebf9559"}, {"url": "https://git.kernel.org/stable/c/607ba280f2adb5092cf5386c3935afac2ca0031a"}, {"url": "https://git.kernel.org/stable/c/59e9ae81f8670ccc780bc75f45a355736f640ec9"}, {"url": "https://git.kernel.org/stable/c/111dcc6d0f016076745824a787d25609d0022f4c"}, {"url": "https://git.kernel.org/stable/c/3b4fd8f15765d9a3105b834dba8a05d025e5e16e"}, {"url": "https://git.kernel.org/stable/c/abe4a6d6f606113251868c2c4a06ba904bb41eed"}], "title": "crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:58.588Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31699", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:12:39.967438Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:06:06.521Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:58.588Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31699", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:12:39.967438Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:12:40.544Z"}}], "cna": {"title": "crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through a local `ioctl(SEV_ISSUE_CMD)` on the `/dev/sev` misc character device with the `SEV_PEK_CSR` subcommand, not through a network or adjacent interface.\nAC:L - An attacker who can issue the ioctl can reliably trigger the bug by providing a CSR buffer length that is too small, causing firmware to return the required larger length. No race or condition outside the attacker's control is required.\nPR:L - The path requires write access to `/dev/sev`; the driver does not enforce a capability check, and reasonable SEV management deployments may delegate writable device access to non-root service or management accounts. Under the required higher-severity rule, this is scored as low privileges rather than root-only.\nUI:N - The attacker directly opens the device and issues the ioctl. No separate victim action is required.\nS:U - The bug affects kernel memory from a local kernel device interface within the same host security scope. It is not a VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The old code copied the firmware-reported required CSR length from a smaller `kzalloc()` buffer, producing a slab out-of-bounds read into userspace. This can leak adjacent kernel heap data and is not limited to only a few bytes.\nI:N - The vulnerability is an out-of-bounds read during `copy_to_user()`, with no kernel memory write or direct control-flow corruption. It does not directly provide an integrity impact.\nA:H - The out-of-bounds usercopy is shown to trigger a KASAN slab-out-of-bounds BUG, and hardened/debug configurations can turn the invalid exposure into an oops or panic. It can be triggered repeatedly by issuing the ioctl again."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "502d10a1d9d477e6c7fc7021a2dac7018f4ab8b5", "versionType": "git"}, {"status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "0fb87e44b81385f940b482cba5b3f0bd18fb8185", "versionType": "git"}, {"status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "372116eece159adff631b1508344c8b85ebf9559", "versionType": "git"}, {"status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "607ba280f2adb5092cf5386c3935afac2ca0031a", "versionType": "git"}, {"status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "59e9ae81f8670ccc780bc75f45a355736f640ec9", "versionType": "git"}, {"status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "111dcc6d0f016076745824a787d25609d0022f4c", "versionType": "git"}, {"status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "3b4fd8f15765d9a3105b834dba8a05d025e5e16e", "versionType": "git"}, {"status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "lessThan": "abe4a6d6f606113251868c2c4a06ba904bb41eed", "versionType": "git"}], "programFiles": ["drivers/crypto/ccp/sev-dev.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.16"}, {"status": "unaffected", "version": "0", "lessThan": "4.16", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.136", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.84", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.25", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.2", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/crypto/ccp/sev-dev.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/502d10a1d9d477e6c7fc7021a2dac7018f4ab8b5"}, {"url": "https://git.kernel.org/stable/c/0fb87e44b81385f940b482cba5b3f0bd18fb8185"}, {"url": "https://git.kernel.org/stable/c/372116eece159adff631b1508344c8b85ebf9559"}, {"url": "https://git.kernel.org/stable/c/607ba280f2adb5092cf5386c3935afac2ca0031a"}, {"url": "https://git.kernel.org/stable/c/59e9ae81f8670ccc780bc75f45a355736f640ec9"}, {"url": "https://git.kernel.org/stable/c/111dcc6d0f016076745824a787d25609d0022f4c"}, {"url": "https://git.kernel.org/stable/c/3b4fd8f15765d9a3105b834dba8a05d025e5e16e"}, {"url": "https://git.kernel.org/stable/c/abe4a6d6f606113251868c2c4a06ba904bb41eed"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed\n\nWhen retrieving the PEK CSR, don't attempt to copy the blob to userspace\nif the firmware command failed. If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n Read of size 2084 at addr ffff898144612e20 by task syz.9.219/21405\n\n CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY\n Tainted: [U]=USER, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n Call Trace:\n <TASK>\n dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n print_address_description ../mm/kasan/report.c:378 [inline]\n print_report+0xbc/0x260 ../mm/kasan/report.c:482\n kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n check_region_inline ../mm/kasan/generic.c:-1 [inline]\n kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n copy_to_user ../include/linux/uaccess.h:236 [inline]\n sev_ioctl_do_pek_csr+0x31f/0x590 ../drivers/crypto/ccp/sev-dev.c:1872\n sev_ioctl+0x3a4/0x490 ../drivers/crypto/ccp/sev-dev.c:2562\n vfs_ioctl ../fs/ioctl.c:51 [inline]\n __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n </TASK>\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.258", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.209", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.136", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.84", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.25", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.2", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "4.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:36.729Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31699", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:06:06.521Z", "dateReserved": "2026-03-09T15:48:24.131Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-01T13:55:59.520Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/crypto/ccp/sev-dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "502d10a1d9d477e6c7fc7021a2dac7018f4ab8b5", "status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "versionType": "git"}, {"lessThan": "0fb87e44b81385f940b482cba5b3f0bd18fb8185", "status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "versionType": "git"}, {"lessThan": "372116eece159adff631b1508344c8b85ebf9559", "status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "versionType": "git"}, {"lessThan": "607ba280f2adb5092cf5386c3935afac2ca0031a", "status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "versionType": "git"}, {"lessThan": "59e9ae81f8670ccc780bc75f45a355736f640ec9", "status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "versionType": "git"}, {"lessThan": "111dcc6d0f016076745824a787d25609d0022f4c", "status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "versionType": "git"}, {"lessThan": "3b4fd8f15765d9a3105b834dba8a05d025e5e16e", "status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "versionType": "git"}, {"lessThan": "abe4a6d6f606113251868c2c4a06ba904bb41eed", "status": "affected", "version": "e799035609e1526761aa2f896a974b233d04d36d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/crypto/ccp/sev-dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.16"}, {"lessThan": "4.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.84", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.25", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A32447F-A6C2-4D97-8B3B-EB4280574173", "versionEndExcluding": "6.6.136", "versionStartIncluding": "4.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7", "versionEndExcluding": "6.12.84", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C", "versionEndExcluding": "6.18.25", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8", "versionEndExcluding": "7.0.2", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed\n\nWhen retrieving the PEK CSR, don't attempt to copy the blob to userspace\nif the firmware command failed. If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n Read of size 2084 at addr ffff898144612e20 by task syz.9.219/21405\n\n CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY\n Tainted: [U]=USER, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n Call Trace:\n <TASK>\n dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n print_address_description ../mm/kasan/report.c:378 [inline]\n print_report+0xbc/0x260 ../mm/kasan/report.c:482\n kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n check_region_inline ../mm/kasan/generic.c:-1 [inline]\n kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n copy_to_user ../include/linux/uaccess.h:236 [inline]\n sev_ioctl_do_pek_csr+0x31f/0x590 ../drivers/crypto/ccp/sev-dev.c:1872\n sev_ioctl+0x3a4/0x490 ../drivers/crypto/ccp/sev-dev.c:2562\n vfs_ioctl ../fs/ioctl.c:51 [inline]\n __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n </TASK>\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: ccp: No intente copiar el CSR al espacio de usuario si el comando PSP fall\u00f3\n\nAl recuperar el CSR de PEK, no intente copiar el blob al espacio de usuario si el comando del firmware fall\u00f3. Si el fallo se debi\u00f3 a una longitud no v\u00e1lida, es decir, el b\u00fafer+longitud del espacio de usuario era demasiado peque\u00f1o, copiar el n\u00famero de bytes que el firmware requiere desbordar\u00e1 el b\u00fafer asignado por el kernel y filtrar\u00e1 datos al espacio de usuario.\n\n ERROR: KASAN: desbordamiento de slab en instrument_copy_to_user .. / include/linux/instrumented.h:129 [inline]\n ERROR: KASAN: desbordamiento de slab en _inline_copy_to_user .. / include/linux/uaccess.h:205 [inline]\n ERROR: KASAN: desbordamiento de slab en _copy_to_user+0x66/0xa0 .. / lib/usercopy.c:26\n Lectura de tama\u00f1o 2084 en la direcci\u00f3n ffff898144612e20 por la tarea syz.9.219/21405\n\n CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY\n Tainted: [U]=USER, [O]=OOT_MODULE\n Nombre del hardware: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n Rastro de llamada:\n [TAREA]\n dump_stack_lvl+0xc5/0x110 .. / lib/dump_stack.c:120\n print_address_description .. / mm/kasan/report.c:378 [inline]\n print_report+0xbc/0x260 .. / mm/kasan/report.c:482\n kasan_report+0xa2/0xe0 .. / mm/kasan/report.c:595\n check_region_inline .. / mm/kasan/generic.c:-1 [inline]\n kasan_check_range+0x264/0x2c0 .. / mm/kasan/generic.c:200\n instrument_copy_to_user .. / include/linux/instrumented.h:129 [inline]\n _inline_copy_to_user .. / include/linux/uaccess.h:205 [inline]\n _copy_to_user+0x66/0xa0 .. / lib/usercopy.c:26\n copy_to_user .. / include/linux/uaccess.h:236 [inline]\n sev_ioctl_do_pek_csr+0x31f/0x590 .. / drivers/crypto/ccp/sev-dev.c:1872\n sev_ioctl+0x3a4/0x490 .. / drivers/crypto/ccp/sev-dev.c:2562\n vfs_ioctl .. / fs/ioctl.c:51 [inline]\n __do_sys_ioctl .. / fs/ioctl.c:597 [inline]\n __se_sys_ioctl+0x11d/0x1b0 .. / fs/ioctl.c:583\n do_syscall_x64 .. / arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xe0/0x800 .. / arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n [/TAREA]\n\nADVERTENCIA si el controlador dice que el comando tuvo \u00e9xito, pero el c\u00f3digo de error del firmware dice lo contrario, ya que se espera que __sev_do_cmd_locked() devuelva -EIO ante cualquier error del firmware."}], "id": "CVE-2026-31699", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31699", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:12:39.967438Z", "version": "2.0.3"}}]}, "published": "2026-05-01T14:16:19.777", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0fb87e44b81385f940b482cba5b3f0bd18fb8185"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/111dcc6d0f016076745824a787d25609d0022f4c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/372116eece159adff631b1508344c8b85ebf9559"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b4fd8f15765d9a3105b834dba8a05d025e5e16e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/502d10a1d9d477e6c7fc7021a2dac7018f4ab8b5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/59e9ae81f8670ccc780bc75f45a355736f640ec9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/607ba280f2adb5092cf5386c3935afac2ca0031a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/abe4a6d6f606113251868c2c4a06ba904bb41eed"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed", "id": "2464372", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464372"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel's crypto: ccp module. A local user could exploit a vulnerability where the system attempts to copy a Certificate Signing Request (CSR) to userspace even after a Platform Security Processor (PSP) command has failed. This can lead to a slab-out-of-bounds write, causing an overflow of the kernel-allocated buffer and potentially leaking sensitive kernel data to the user."], "name": "CVE-2026-31699", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31699\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31699\nhttps://lore.kernel.org/linux-cve-announce/2026050119-CVE-2026-31699-5ba8@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e799035609e1526761aa2f896a974b233d04d36d,607ba280f2adb5092cf5386c3935afac2ca0031a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e799035609e1526761aa2f896a974b233d04d36d,59e9ae81f8670ccc780bc75f45a355736f640ec9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e799035609e1526761aa2f896a974b233d04d36d,111dcc6d0f016076745824a787d25609d0022f4c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e799035609e1526761aa2f896a974b233d04d36d,3b4fd8f15765d9a3105b834dba8a05d025e5e16e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e799035609e1526761aa2f896a974b233d04d36d,abe4a6d6f606113251868c2c4a06ba904bb41eed)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.136,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.84,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.25,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.2,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T20:30:05.026237+00:00", "updated": "2026-10-23T08:45:16.398188+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}