A flaw in the Linux kernel's CCP driver allows an attacker to request a firmware command that fails because the supplied userspace buffer is too small. Instead of rejecting the request, the driver erroneously copies the size reported by the firmware into the user buffer, which can be larger than the allocated area. This out‑of‑bounds copy leaks kernel memory into userspace. The vulnerability corresponds to CWE‑125, CWE‑787, and CWE‑805 and is rated medium‑high (CVSS 7.1).

The issue exists in all Linux kernel builds that include the sev‑dev CCP driver and expose the /dev/sev ioctl interface. Known affected CPEs cover the generic Linux kernel as well as the 7.1 release candidates (rc1 and rc2). Any system running a kernel that contains the sev‑dev module without the patch may be vulnerable.

Exploitation requires a locally running process with permission to send ioctl requests to /dev/sev. By crafting a command that fails because the buffer is too small, the attacker can trigger the out‑of‑bounds copy and read kernel memory. The EPSS score is 0.17 % and the vulnerability is not listed in CISA KEV, indicating low to moderate prevalence. The attack vector is local and requires kernel‑level code execution or local privilege to use /dev/sev, but once achieved, it enables disclosure of arbitrary kernel data.