CVE-2026-31699: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31699 Overview

CVE-2026-31699 is an out-of-bounds read vulnerability [CWE-787] in the Linux kernel's AMD Cryptographic Coprocessor (CCP) driver. The flaw resides in the Secure Encrypted Virtualization (SEV) subsystem, specifically in the sev_ioctl_do_pek_csr() function in drivers/crypto/ccp/sev-dev.c. When the Platform Endorsement Key (PEK) Certificate Signing Request (CSR) firmware command fails due to an undersized userspace buffer, the kernel still attempts to copy the firmware-required byte count, overflowing the kernel-allocated buffer and leaking adjacent slab memory to userspace.

Critical Impact
Local users with access to the /dev/sev device can trigger a kernel slab out-of-bounds read, leaking sensitive kernel memory and potentially crashing the system.

Affected Products

Linux Kernel (mainline) prior to patched commits
Linux Kernel 7.1-rc1
Linux Kernel 7.1-rc2

Discovery Timeline

2026-05-01 - CVE-2026-31699 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31699

Vulnerability Analysis

The vulnerability exists in the AMD Secure Processor (PSP) ioctl handler that retrieves the PEK CSR blob. When userspace invokes the SEV_PEK_CSR ioctl with an undersized buffer, the firmware command returns an INVALID_LENGTH error code along with the actual length the firmware requires. The driver previously continued execution after this failure and called copy_to_user() using the firmware-reported length rather than the size of the kernel buffer originally allocated for the request.

The result is a slab out-of-bounds read confirmed by KASAN, with reads of approximately 2084 bytes against a smaller kernel allocation. The leaked bytes originate from neighboring slab objects and may include sensitive kernel data structures. The fix in commit abe4a6d6f606113251868c2c4a06ba904bb41eed and related stable backports skips the user copy when the PSP command fails and emits a WARN if the driver and firmware error states disagree.

Root Cause

The root cause is an absent error check between firmware command failure and the subsequent userspace copy. The function __sev_do_cmd_locked() is expected to return -EIO on any firmware error, but the caller path in sev_ioctl_do_pek_csr() failed to honor that contract before invoking _copy_to_user(). Combined with the firmware writing back its required length on failure, the kernel uses an attacker-influenced size against an undersized buffer.

Attack Vector

A local unprivileged or low-privileged user with access to the /dev/sev character device opens the device and issues the SEV_PEK_CSR ioctl with a deliberately small buffer length. The firmware rejects the request with INVALID_LENGTH and reports its required size. The kernel then performs the over-read and copies adjacent slab contents into the user-supplied pointer, exposing kernel memory or causing a denial of service when the read crosses a slab boundary.

No public exploit or proof-of-concept is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-31699

Indicators of Compromise

KASAN reports referencing slab-out-of-bounds in instrument_copy_to_user or _copy_to_user originating from sev_ioctl_do_pek_csr+0x31f/0x590.
Kernel WARN messages from the CCP driver indicating a mismatch between driver return code and firmware error code on PSP commands.
Unexpected processes opening /dev/sev and issuing SEV_ISSUE_CMD ioctls with the SEV_PEK_CSR subcommand.

Detection Strategies

Audit ioctl() syscalls targeting /dev/sev using auditd or eBPF probes, focusing on non-virtualization-management workloads invoking SEV_PEK_CSR.
Correlate kernel ring buffer entries containing KASAN, BUG:, or WARN_ON originating from drivers/crypto/ccp/sev-dev.c against running kernel versions.
Inventory hosts running on AMD EPYC platforms with SEV enabled and cross-reference kernel build versions against the patched stable commits.

Monitoring Recommendations

Monitor /dev/sev device permissions and alert on group membership changes that grant non-root processes access.
Enable kernel lockdown or KASAN in test fleets to surface out-of-bounds reads in pre-production.
Forward kernel logs to a centralized SIEM and create rules for repeated PSP command failures, which can indicate probing activity.

How to Mitigate CVE-2026-31699

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits abe4a6d6f606113251868c2c4a06ba904bb41eed, 607ba280f2adb5092cf5386c3935afac2ca0031a, 59e9ae81f8670ccc780bc75f45a355736f640ec9, 3b4fd8f15765d9a3105b834dba8a05d025e5e16e, and 111dcc6d0f016076745824a787d25609d0022f4c.
Restrict access to /dev/sev to trusted virtualization management daemons only.
Identify hosts running AMD SEV-capable kernels and prioritize them for patching.

Patch Information

The upstream fix modifies sev_ioctl_do_pek_csr() to bail out before calling copy_to_user() whenever the PSP firmware command fails, and adds a WARN to detect future driver-firmware error code drift. Distribution vendors are issuing backports through their standard kernel update channels. See the Linux kernel stable commit for the canonical patch.

Workarounds

Tighten file mode and ACLs on /dev/sev so only the hypervisor management user can open the device.
Disable SEV in BIOS/UEFI on systems that do not require AMD confidential computing features.
Use Linux Security Modules such as SELinux or AppArmor to restrict which processes can issue ioctls to the CCP driver.

bash

# Restrict access to the AMD SEV device to a dedicated group
chgrp sev-admins /dev/sev
chmod 0660 /dev/sev

# Verify currently running kernel against patched stable releases
uname -r
zgrep 'abe4a6d6f6061' /proc/config.gz 2>/dev/null || \
  echo 'Confirm kernel package version includes CVE-2026-31699 backport'