The flaw arises from a bug in the Linux kernel’s CCP crypto driver where a zero‑length user‑supplied certificate chain for PDH export is treated as a request for blob lengths but is not validated. The code then attempts to fetch the physical address of a zero‑size pointer returned by kzalloc, triggering a BUG_ON that aborts the kernel. This results in an Oops and can lead to a kernel panic, effectively causing a denial of service when the affected ioctl is invoked. It is inferred that the attacker must have local privileged access to craft and send the offending ioctl request.

The vulnerability affects the Linux kernel when CONFIG_DEBUG_VIRTUAL is enabled, as exercised in the drivers/crypto/ccp/sev-dev.c and arch/x86/mm/physaddr.c code paths. Any distribution shipping a kernel compiled with this configuration and using the CCP crypto driver may be impacted; the patch was incorporated in kernel 6.18 and later, but the exact distribution release is not specified.

The CVSS score of 5.5 indicates moderate severity, EPSS score of < 1% shows a low likelihood of exploitation, and the vulnerability is not in the CISA KEV catalog. The bug only activates when a zero‑length buffer is passed to the ioctl and CONFIG_DEBUG_VIRTUAL is enabled, limiting the exploitation surface. It is inferred that the likely attack vector requires local privileged execution of the ioctl call, as the code paths are not exposed to unprivileged users.