CVE-2026-80652 Overview
CVE-2026-80652 is a Linux kernel vulnerability in the AMD Cryptographic Coprocessor (CCP) driver that handles AMD Secure Encrypted Virtualization (SEV) operations. The flaw resides in the sev_ioctl_do_pdh_export() function in drivers/crypto/ccp/sev-dev.c. When userspace supplies a zero-length certificate chain buffer during a Platform Diffie-Hellman (PDH) export ioctl, the driver fails to treat it as a length-query request. Instead, kzalloc() returns ZERO_SIZE_PTR, and the driver later attempts to resolve its physical address, triggering a BUG_ON() in __phys_addr() on kernels built with CONFIG_DEBUG_VIRTUAL=y.
Critical Impact
A local user with access to the SEV device ioctl interface can trigger a kernel BUG_ON, causing a denial-of-service on kernels compiled with CONFIG_DEBUG_VIRTUAL=y.
Affected Products
- Linux kernel builds containing the AMD CCP/SEV driver (drivers/crypto/ccp/sev-dev.c)
- Kernels compiled with CONFIG_DEBUG_VIRTUAL=y (crash impact)
- Reproduction observed on kernel version 6.18.16-smp-DEV
Discovery Timeline
- 2026-08-28 - CVE-2026-80652 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80652
Vulnerability Analysis
The vulnerability is a kernel-level input validation error [CWE-20] in the AMD Secure Processor (PSP) SEV ioctl handler. The SEV_PDH_CERT_EXPORT ioctl is designed to export the Platform Diffie-Hellman public key and certificate chain to userspace. A common usage pattern involves an initial call with a zero-length buffer to query the required blob sizes, followed by a second call with a correctly sized buffer.
The driver failed to short-circuit the zero-length case. It called kzalloc(0, ...), which returns the sentinel ZERO_SIZE_PTR (address 0x10), then passed that pointer to __phys_addr(). Under CONFIG_DEBUG_VIRTUAL=y, __phys_addr() validates that the input lies within the direct map. The sentinel does not, so it hits BUG_ON() at arch/x86/mm/physaddr.c:28, producing an invalid opcode oops and killing the calling task.
Outside of CONFIG_DEBUG_VIRTUAL=y the defect is benign: address translation is arithmetic-only, and the PSP firmware rejects the request before any DMA write occurs. This prevents memory corruption at physical frame zero.
Root Cause
The root cause is the omission of a zero-length check on the userspace-supplied cert_chain_len parameter before allocation and physical address translation. kzalloc(0, GFP_KERNEL) returns ZERO_SIZE_PTR rather than NULL, and subsequent virt_to_phys() calls on that sentinel are invalid.
Attack Vector
Exploitation requires local access to /dev/sev and permission to invoke the SEV_PDH_CERT_EXPORT ioctl. An unprivileged process with the necessary device access can submit a crafted ioctl containing a zero-length cert_chain_uaddr buffer. On debug-instrumented kernels the resulting BUG_ON terminates the task and taints the kernel. The syzkaller-style reproducer in the crash report demonstrates the trigger through sev_ioctl() → sev_ioctl_do_pdh_export().
No verified public exploit exists beyond the fuzzer-generated reproducer embedded in the kernel commit message. See the upstream fix in Kernel Patch Commit 13b4d5e for the exact code path.
Detection Methods for CVE-2026-80652
Indicators of Compromise
- Kernel oops messages referencing kernel BUG at arch/x86/mm/physaddr.c:28 with __phys_addr+0x16a/0x180 in the call trace.
- Call stack frames including sev_ioctl_do_pdh_export and sev_ioctl in drivers/crypto/ccp/sev-dev.c.
- Kernel taint flag W (WARN) appearing on hosts that expose the SEV device to non-root workloads.
Detection Strategies
- Monitor /var/log/kern.log, dmesg, and journalctl -k output for the signature sev_ioctl_do_pdh_export co-occurring with invalid opcode or BUG_ON.
- Audit which processes open /dev/sev using auditd rules on the device node to identify unexpected callers.
- Track SEV_PDH_CERT_EXPORT ioctl invocations on hypervisor hosts running confidential-computing workloads.
Monitoring Recommendations
- Ingest kernel logs into a centralized logging pipeline and alert on kernel oops or panic events on AMD EPYC hypervisors.
- Correlate ioctl activity against /dev/sev with process lineage to detect fuzzing or reconnaissance behavior.
- Track the running kernel build configuration (CONFIG_DEBUG_VIRTUAL) across the fleet to identify hosts exposed to the crash path.
How to Mitigate CVE-2026-80652
Immediate Actions Required
- Apply the upstream Linux stable patches referenced below to all AMD EPYC hosts running SEV workloads.
- Restrict access to /dev/sev to trusted virtualization management processes via file permissions and Linux capabilities.
- On non-production and debug kernels, disable CONFIG_DEBUG_VIRTUAL if patches cannot be applied immediately.
Patch Information
The fix teaches sev_ioctl_do_pdh_export() to treat a zero-length userspace certificate chain buffer as a query for the required blob lengths, bypassing the erroneous kzalloc(0) and subsequent physical-address translation. The patch has been backported across multiple stable branches. Reference commits: 13b4d5e, 1c587f3, 21650fe, 50c3c7d, 94344bc, d88071a, ee717e7, and ef8c9da.
Workarounds
- Tighten permissions on /dev/sev so only the hypervisor management daemon can issue ioctls against it.
- Rebuild affected debug kernels with CONFIG_DEBUG_VIRTUAL=n until the patch can be deployed, accepting reduced kernel diagnostics.
- Disable the CCP/SEV driver on hosts that do not run confidential VMs by blacklisting the ccp module.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
