CVE-2026-31698: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31698 Overview

CVE-2026-31698 is an out-of-bounds read vulnerability [CWE-787] in the Linux kernel's AMD Cryptographic Coprocessor (CCP) driver. The flaw resides in the Secure Encrypted Virtualization (SEV) Platform Diffie-Hellman (PDH) certificate export path within drivers/crypto/ccp/sev-dev.c. When the firmware command fails due to an undersized userspace buffer, the driver still copies the firmware-required byte count to userspace, overflowing the kernel-allocated buffer and leaking adjacent kernel memory.

Critical Impact

A local authenticated user can trigger a kernel slab out-of-bounds read via the SEV_PDH_CERT_EXPORT ioctl, leaking sensitive kernel heap data and potentially crashing the host.

Affected Products

• Linux Kernel (mainline)
• Linux Kernel 7.1-rc1
• Linux Kernel 7.1-rc2

Discovery Timeline

• 2026-05-01 - CVE-2026-31698 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31698

Vulnerability Analysis

The vulnerability resides in sev_ioctl_do_pdh_export() at drivers/crypto/ccp/sev-dev.c:2347. The function handles the SEV_PDH_CERT_EXPORT ioctl, which retrieves the Platform Diffie-Hellman certificate and certificate chain from AMD Secure Processor firmware. When userspace provides a buffer that is too small, the firmware command fails with an invalid-length error code. The driver did not bail out on this failure path before invoking copy_to_user().

The copy_to_user() call uses the byte count the firmware reports it requires, not the size of the kernel-allocated buffer. KASAN flagged a 2084-byte read at ffff8885c4ab8aa0 originating from _copy_to_user+0x66/0xa0. This results in a slab out-of-bounds read that exfiltrates adjacent kernel heap contents to userspace.

Root Cause

The root cause is a missing error-path check after the PSP firmware command. The driver assumed __sev_do_cmd_locked() would surface firmware errors as -EIO, but the export path proceeded to copy blob data even when the firmware returned an invalid-length status. Combined with using firmware-supplied lengths instead of the kernel buffer size, this produces a slab-out-of-bounds read [CWE-787].

Attack Vector

Exploitation requires local access to /dev/sev and the privileges needed to issue SEV ioctls. An attacker calls the SEV_PDH_CERT_EXPORT ioctl with intentionally undersized buffer length fields. The firmware rejects the request, but the driver still executes copy_to_user() using the firmware's expected length. The attacker receives kernel heap memory beyond the allocated PDH buffer, potentially exposing cryptographic material, pointers useful for KASLR bypass, or other sensitive kernel state.

Detection Methods for CVE-2026-31698

Indicators of Compromise

• KASAN reports referencing slab-out-of-bounds in instrument_copy_to_user with call stacks containing sev_ioctl_do_pdh_export or sev_ioctl.
• Kernel log entries showing failed SEV_PDH_CERT_EXPORT ioctl calls followed by anomalous user-space reads.
• Unexpected processes opening /dev/sev outside of legitimate SEV management tooling.

Detection Strategies

• Audit ioctl() syscalls targeting /dev/sev with command code SEV_PDH_CERT_EXPORT, correlating caller UID and process lineage.
• Deploy eBPF or auditd rules to flag non-root or unexpected processes invoking SEV ioctls on AMD EPYC hosts.
• Run KASAN-enabled kernels in pre-production to surface out-of-bounds reads triggered by fuzzing the SEV ioctl interface.

Monitoring Recommendations

• Forward kernel ring buffer entries containing KASAN, BUG:, or sev-dev strings to a centralized logging pipeline for alerting.
• Track running kernel versions across the fleet to confirm patched commits are deployed on all AMD SEV-capable hosts.
• Alert on repeated failed SEV ioctl invocations from a single PID or container, which can indicate exploitation attempts.

How to Mitigate CVE-2026-31698

Immediate Actions Required

• Apply the upstream stable kernel patches referenced below and reboot affected hosts running AMD SEV workloads.
• Restrict access to /dev/sev to trusted administrators and confidential-computing management daemons only.
• On systems that do not run SEV guests, unload or disable the ccp module to remove the attack surface entirely.

Patch Information

The fix ensures sev_ioctl_do_pdh_export() does not copy blobs to userspace when the PSP command fails, and adds a WARN when the driver and firmware status disagree. Stable backports are available in the following commits: 051e51aa55fd, 50808c13452d, 78b97e43d0b3, b5c14bd4da1f, and e76239fed3cf.

Workarounds

• Tighten DAC permissions on /dev/sev so only privileged management users can issue ioctls.
• Use Linux capabilities or seccomp filters to block ioctl syscalls on the SEV device for non-essential workloads.
• Disable the ccp kernel module on hosts that do not require AMD SEV until the patched kernel is rolled out.

# Restrict /dev/sev access and disable ccp where unused
chown root:root /dev/sev
chmod 0600 /dev/sev
echo "blacklist ccp" | sudo tee /etc/modprobe.d/disable-ccp.conf
sudo modprobe -r ccp 2>/dev/null || true