The flaw resides in the Linux kernel CCP driver: when a firmware command returns an error due to an invalid length, the driver still copies the kernel‑side ID blob into user space. That copy uses the firmware‑reported length, which may exceed the size of the kernel buffer, causing an out‑of‑bounds read and leaking kernel memory to user space. This is a classic heap out‑of‑bounds read (CWE‑125, CWE‑787, CWE‑805) that allows an attacker to see data that should remain protected.

The vulnerability affects the Linux kernel on all Linux distributions that ship the unpatched CCP driver. The CPE list includes any kernel build and also explicit kernel 7.1 release candidates 7.1rc1 and 7.1rc2, meaning those versions are known to contain the flaw. Any system running a kernel with the current CCP code and without the recent fix is potentially affected.

Exploitation requires local execution with the ability to open the CCP device (typically /dev/sev) and invoke the ioctl. No remote vectors are described and the EPSS score of <1% and the absence of a KEV listing indicate a low overall risk of exploitation. The CVSS score of 7.1 reflects medium severity, primarily due to potential confidentiality compromise. The attacker would first trigger a firmware error that results in an invalid length, causing the kernel to overwrite the userspace buffer and expose hidden kernel memory. The blowup does not grant code execution, but the leaked data could aid further attacks such as local privilege escalation.