A bug in the Linux kernel’s crypto subsystem causes the kernel to copy a firmware‑generated CSR blob to userspace even when the underlying firmware command fails. The copy operation uses the firmware‑reported length rather than the size of the userspace buffer, which can lead to a slab‑out‑of‑bounds write and the exposure of secret data to unprivileged processes. The flaw constitutes an out‑of‑bounds data‑copy that results in information leakage, potentially revealing sensitive cryptographic material.

The vulnerability applies to the Linux (Linux) kernel, specifically the crypto:ccp / sev‑dev driver path. Affected kernel versions are not enumerated in the available data, so all deployments running this driver prior to a fix may be impacted.

The exploit is local and requires the ability to trigger the vulnerable ioctl on the sev‑dev driver. Since the flaw allows memory corruption and data leakage, it can be considered a high‑impact security issue if an attacker can control the ioctl payload. The CVSS score is 7.0, indicating medium to high severity, and the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, indicating that widespread exploitation has not been observed to date. Despite this, the potential for confidential data exposure warrants careful monitoring and timely patching when a fix becomes available.