In the Linux kernel, a flaw in the Cryptographic Coprocessor (CCP) driver allows the kernel to copy data from firmware to userspace even after the firmware reports a failure due to an invalid length. The copy operation uses a size larger than the allocated buffer, resulting in an out‑of‑bounds read that can expose arbitrary kernel memory to the caller. This information exposure corresponds to CWE-805, "Buffer Access Using Size of Incorrect Type".

The issue affects Linux kernels that include the CCP driver, particularly those that load the sev‑dev module and expose the /dev/sev ioctl interface. No specific kernel versions are listed, so any system running a kernel that includes this driver and allows local use of the /dev/sev device may be affected.

Exploitation requires a process with permission to issue ioctl requests to the sev driver; the path involves triggering a firmware command that fails due to an over‑large length request, after which the kernel copies the firmware‑required size into the user buffer. Based on the description, it is inferred that a local attacker who can craft such ioctl calls can read kernel memory content into their buffer. No EPSS score is available, the vulnerability is not listed in CISA KEV, and the exploitability therefore depends on local privilege and driver exposure.