In the Linux kernel, a flaw in the Cryptographic Coprocessor (CCP) driver permits the kernel to copy data from firmware to userspace even after the firmware reports a failure caused by an invalid length. Because the userspace buffer is smaller than the size required by the firmware, the kernel uses the firmware‑defined size for the copy, overflowing the kernel‑allocated buffer and leaking kernel memory to the caller. This data disclosure corresponds to CWE‑805, "Buffer Access Using Size of Incorrect Type", and involves only an out‑of‑bounds read.

Affected systems include Linux kernel versions 7.1 rc1 and rc2, and any kernel that contains the CCP driver and exposes the /dev/sev ioctl interface. No specific stable release versions are listed, so any system that installs the sev‑dev module and allows local use of /dev/sev may be vulnerable.

Exploitation requires a process with permission to issue ioctl requests to the sev driver. The attacker triggers a firmware command that fails because the user buffer is too small; the kernel then copies the firmware‑required size into the user buffer, performing an out‑of‑bounds read. A local attacker who can craft such ioctl calls can read kernel memory. The EPSS score is <1%, the vulnerability is not listed in CISA KEV, and the exploitability depends on local privilege and driver exposure.