CVE-2026-53016: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53016 Overview

CVE-2026-53016 is a Linux kernel vulnerability in the AMD Cryptographic Coprocessor (CCP) driver. The flaw resides in the ccp_aes_complete() function, which restores AES_BLOCK_SIZE (16 bytes) of initialization vector (IV) data into the caller's buffer. RFC3686 skciphers, such as rfc3686-ctr-aes-ccp, only expose an 8-byte IV via the AF_ALG interface. The mismatch causes an out-of-bounds write that overruns the provided buffer. The fix replaces the fixed-size copy with crypto_skcipher_ivsize() so only the algorithm's declared IV length is written.

Critical Impact
An out-of-bounds write in the kernel crypto path can corrupt adjacent memory, leading to denial of service or potential local privilege escalation on systems exposing AF_ALG to unprivileged users.

Affected Products

Linux kernel builds including the drivers/crypto/ccp AES driver
Systems with AMD CCP hardware using rfc3686(ctr(aes)) via AF_ALG
Multiple stable kernel branches referenced in the upstream commits

Discovery Timeline

2026-06-24 - CVE-2026-53016 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53016

Vulnerability Analysis

The vulnerability is an Out-of-Bounds Write [CWE-787] in the AMD CCP crypto driver. When user space submits an rfc3686-ctr-aes-ccp request through the AF_ALG socket interface, the kernel allocates an 8-byte IV buffer because RFC3686 reserves the remaining 8 bytes for the nonce and counter. After the operation, ccp_aes_complete() writes back AES_BLOCK_SIZE (16 bytes) of IV data into that 8-byte caller buffer. The extra 8 bytes overrun the destination and corrupt whatever lies beyond it in kernel memory.

Root Cause

The completion handler hardcoded the copy length to the AES block size instead of querying the skcipher transform for its actual IV size. RFC3686 mode advertises an 8-byte IV through crypto_skcipher_ivsize(), but the driver ignored this value and assumed every AES variant uses a full 16-byte IV.

Attack Vector

A local user with access to the AF_ALG algif_skcipher interface can submit rfc3686(ctr(aes)) requests handled by the CCP driver. Each completed request triggers the oversized IV copy, writing attacker-influenced bytes past the end of the kernel's IV buffer. Repeated requests can be used to probe adjacent allocations or destabilize the kernel.

No verified public exploit code is available. The vulnerability is described in the upstream Linux kernel commits referenced below.

Detection Methods for CVE-2026-53016

Indicators of Compromise

Unexpected kernel oops or slab corruption messages referencing ccp_aes_complete or ccp-crypto modules
KASAN reports flagging out-of-bounds writes in the CCP driver path
Unprivileged processes opening AF_ALG sockets and binding to rfc3686(ctr(aes)) on AMD CCP hardware

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface the out-of-bounds write at runtime
Audit kernel build metadata (uname -r) against the patched stable releases referenced in the Linux kernel commits
Monitor dmesg for crypto driver faults and slab corruption traces tied to CCP operations

Monitoring Recommendations

Log AF_ALG socket usage by non-root processes through auditd rules on the socket syscall with family AF_ALG
Alert on kernel crashes that include ccp or skcipher symbols in the stack trace
Track package update status across AMD-equipped Linux fleets to confirm the patched kernel is deployed

How to Mitigate CVE-2026-53016

Immediate Actions Required

Apply the patched Linux kernel containing the fix that uses crypto_skcipher_ivsize() when copying the IV in ccp_aes_complete()
Update to the stable kernel branches that include the upstream commits listed under technical references
Restrict access to the AF_ALG interface on multi-tenant systems until the patched kernel is installed

Patch Information

The fix replaces the hardcoded AES_BLOCK_SIZE copy with the skcipher's declared IV length. Multiple stable backports are available, including Linux Kernel Commit 227c1e1d, Linux Kernel Commit 798d409a, Linux Kernel Commit 939061b2, Linux Kernel Commit a7a1f3cd, Linux Kernel Commit bb01d8f1, Linux Kernel Commit df9784bb, Linux Kernel Commit dfb2cf43, and Linux Kernel Commit eecee15e.

Workarounds

Disable the ccp-crypto module on systems that do not require hardware-accelerated crypto via the CCP
Block loading of algif_skcipher to remove user-space access to the affected code path
Enforce SELinux or AppArmor policies that restrict the AF_ALG socket family to trusted processes

bash

# Configuration example
# Prevent the AF_ALG skcipher interface from being loaded
echo 'install algif_skcipher /bin/true' | sudo tee /etc/modprobe.d/disable-algif-skcipher.conf

# Optionally unload the CCP crypto module if not required
sudo modprobe -r ccp_crypto || true

# Verify the running kernel includes the patched version
uname -r