A bug in the Linux kernel’s crypto subsystem causes the kernel to copy a firmware‑generated CSR blob to userspace even when the underlying firmware command fails. Because the copy operation uses the firmware‑reported length rather than the size of the callers buffer, it can trigger an out‑of‑bounds write (CWE‑787) and subsequently cause a slab‑out‑of‑bounds read that leaks secret data (CWE‑125). The flaw originates in the sev‑dev driver’s ioctl handling, and an attacker who can trigger the vulnerable ioctl can read data beyond the allocated buffer boundary, potentially exposing cryptographic material or other sensitive kernel data.

The vulnerability affects the Linux kernel’s sev‑dev driver; it is present in kernel releases 7.1‑rc1 and 7.1‑rc2, and any earlier kernel versions that include the same driver implementation. All deployments running the sev‑dev driver before the fix may be impacted.

The flaw is exploitable locally: an attacker with the ability to invoke the vulnerable ioctl can cause a memory corruption that leaks data. The CVSS score of 7.1 signifies a medium to high severity, while the EPSS score of < 1% shows that exploitation is presently unlikely. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Because the issue can expose cryptographic secrets, it warrants monitoring and timely patching once a fix is available.