CVE-2026-80652 - Vulnerability Details

- crypto: ccp - Treat zero-length cert chain as query for blob lengths

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Treat zero-length cert chain as query for blob lengths

When handling a PDH export, treat a zero-length userspace cert chain buffer
as a request to query the length of the relevant blobs. Failure to account
for the zero-length buffer trips a BUG_ON() when running with
CONFIG_DEBUG_VIRTUAL=y due to trying to get the physical address of the
ZERO_SIZE_PTR (returned by kzalloc() on the bogus allocation).

kernel BUG at arch/x86/mm/physaddr.c:28 !
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 30 UID: 0 PID: 28580 Comm: syz.2.18 Kdump: loaded
Tainted: G W 6.18.16-smp-DEV #1 NONE
Tainted: [W]=WARN
Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025
RIP: 0010:__phys_addr+0x16a/0x180 arch/x86/mm/physaddr.c:28
RSP: 0018:ffffc9008329fc80 EFLAGS: 00010293
RAX: ffffffff8179110a RBX: 0000778000000010 RCX: ffff8884e6992600
RDX: 0000000000000000 RSI: 0000000080000010 RDI: 0000778000000010
RBP: ffffc9008329fdf0 R08: 0000000000000dc0 R09: 00000000ffffffff
R10: dffffc0000000000 R11: fffffbfff126d297 R12: dffffc0000000000
R13: 1ffff92010653fc8 R14: 0000000080000010 R15: dffffc0000000000
FS: 0000555556bec9c0(0000) GS:ffff88aa4ce1c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd3159e7000 CR3: 00000004fbc44000 CR4: 0000000000350ef0
Call Trace:
<TASK>
[<ffffffff853d3869>] sev_ioctl_do_pdh_export+0x559/0x7a0 drivers/crypto/ccp/sev-dev.c:2308
[<ffffffff853d1fdd>] sev_ioctl+0x2cd/0x480 drivers/crypto/ccp/sev-dev.c:2556
[<ffffffff82549ebc>] vfs_ioctl fs/ioctl.c:52 [inline]
[<ffffffff82549ebc>] __do_sys_ioctl fs/ioctl.c:598 [inline]
[<ffffffff82549ebc>] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584
[<ffffffff8630115f>] do_syscall_x64 arch/x86/entry/syscall_64.c:64 [inline]
[<ffffffff8630115f>] do_syscall_64+0x9f/0xf40 arch/x86/entry/syscall_64.c:98
[<ffffffff81000136>] entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fd3158eac39
</TASK>

Thankfully, the bug is benign outside of CONFIG_DEBUG_VIRTUAL=y as getting
the physical address is just arithmetic, and the PSP errors out before
trying to write to the garbage address (which it must, otherwise querying
the blob lengths would clobber memory at pfn=0).

Published: 2026-08-28

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The flaw arises from a bug in the Linux kernel’s CCP crypto driver where a zero‑length user‑supplied certificate chain for PDH export is treated as a request for blob lengths but is not validated. The code then attempts to fetch the physical address of a zero‑size pointer returned by kzalloc, triggering a BUG_ON that aborts the kernel. This results in an Oops and can lead to a kernel panic, effectively causing a denial of service when the affected ioctl is invoked.

Affected Systems

The vulnerability affects the Linux kernel when CONFIG_DEBUG_VIRTUAL is enabled, as exercised in the drivers/crypto/ccp/sev-dev.c and arch/x86/mm/physaddr.c code paths. Any distribution shipping a kernel compiled with this configuration and using the CCP crypto driver may be impacted; the patch was incorporated in kernel 6.18 and later, but the exact distribution release is not specified.

Risk and Exploitability

The CVSS score is not listed, EPSS is unavailable, and the vulnerability is not in the CISA KEV catalog. The bug only activates when a zero‑length buffer is passed to the ioctl and CONFIG_DEBUG_VIRTUAL is enabled, limiting the exploitation surface. No evidence suggests that a remote attacker can trigger the condition without local kernel code execution privileges, making the most likely vector a local privileged user crafting the ioctl call.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`76a2b524a4b1d6dc0f2421f9854a01d55d5e5436`	affected	< 1c587f30c6242cc37b3d6ee6d91daef84e51633f
`76a2b524a4b1d6dc0f2421f9854a01d55d5e5436`	affected	< 13b4d5e055d344e34b864bced0a591ceaac7ad81
`76a2b524a4b1d6dc0f2421f9854a01d55d5e5436`	affected	< 94344bc7c9d70b04be718d841b92873aa3ea8191
`76a2b524a4b1d6dc0f2421f9854a01d55d5e5436`	affected	< 50c3c7df4f26d36b30bc950a7d780f7029fd52f8
`76a2b524a4b1d6dc0f2421f9854a01d55d5e5436`	affected	< ee717e73ab47253c82c134c342e32fcdfcfccd87
`76a2b524a4b1d6dc0f2421f9854a01d55d5e5436`	affected	< 21650fe221ea9b72809140b691589dde8bff3eab
`76a2b524a4b1d6dc0f2421f9854a01d55d5e5436`	affected	< d88071a6ce091272726bedda26c105b85b23705f
`76a2b524a4b1d6dc0f2421f9854a01d55d5e5436`	affected	< ef8c9dacda2871accd64e3eda951fef6b788b1ea

Linux

affected

Version	Status	Constraints
`4.16`	affected	—
`0`	unaffected	< 4.16
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[76a2b524a4b1d6dc0f2421f9854a01d55d5e5436,1c587f30c6242cc37b3d6ee6d91daef84e51633f)`	affected	code_commit	—
`[76a2b524a4b1d6dc0f2421f9854a01d55d5e5436,13b4d5e055d344e34b864bced0a591ceaac7ad81)`	affected	code_commit	—
`[76a2b524a4b1d6dc0f2421f9854a01d55d5e5436,94344bc7c9d70b04be718d841b92873aa3ea8191)`	affected	code_commit	—
`[76a2b524a4b1d6dc0f2421f9854a01d55d5e5436,50c3c7df4f26d36b30bc950a7d780f7029fd52f8)`	affected	code_commit	—
`[76a2b524a4b1d6dc0f2421f9854a01d55d5e5436,ee717e73ab47253c82c134c342e32fcdfcfccd87)`	affected	code_commit	—
`[76a2b524a4b1d6dc0f2421f9854a01d55d5e5436,21650fe221ea9b72809140b691589dde8bff3eab)`	affected	code_commit	—
`[76a2b524a4b1d6dc0f2421f9854a01d55d5e5436,d88071a6ce091272726bedda26c105b85b23705f)`	affected	code_commit	—
`[76a2b524a4b1d6dc0f2421f9854a01d55d5e5436,ef8c9dacda2871accd64e3eda951fef6b788b1ea)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.16`	affected	generic	—
`[0,4.16)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a recent kernel version, such as Linux 6.18 or later, that contains the patch for this bug.
Compile the kernel with CONFIG_DEBUG_VIRTUAL disabled in production environments to eliminate the BUG_ON path.
Validate the certificate chain length in user space before invoking the CCP ioctl to avoid sending a zero‑length buffer.

Generated by OpenCVE AI on August 28, 2026 at 10:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/13b4d5e055d344e34b864bced0a591ceaac7ad81
https://git.kernel.org/stable/c/1c587f30c6242cc37b3d6ee6d91daef84e51633f
https://git.kernel.org/stable/c/21650fe221ea9b72809140b691589dde8bff3eab
https://git.kernel.org/stable/c/50c3c7df4f26d36b30bc950a7d780f7029fd52f8
https://git.kernel.org/stable/c/94344bc7c9d70b04be718d841b92873aa3ea8191
https://git.kernel.org/stable/c/d88071a6ce091272726bedda26c105b85b23705f
https://git.kernel.org/stable/c/ee717e73ab47253c82c134c342e32fcdfcfccd87
https://git.kernel.org/stable/c/ef8c9dacda2871accd64e3eda951fef6b788b1ea

History

Fri, 28 Aug 2026 10:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 28 Aug 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the zero-length buffer trips a BUG_ON() when running with CONFIG_DEBUG_VIRTUAL=y due to trying to get the physical address of the ZERO_SIZE_PTR (returned by kzalloc() on the bogus allocation). kernel BUG at arch/x86/mm/physaddr.c:28 ! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 30 UID: 0 PID: 28580 Comm: syz.2.18 Kdump: loaded Tainted: G W 6.18.16-smp-DEV #1 NONE Tainted: [W]=WARN Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 RIP: 0010:__phys_addr+0x16a/0x180 arch/x86/mm/physaddr.c:28 RSP: 0018:ffffc9008329fc80 EFLAGS: 00010293 RAX: ffffffff8179110a RBX: 0000778000000010 RCX: ffff8884e6992600 RDX: 0000000000000000 RSI: 0000000080000010 RDI: 0000778000000010 RBP: ffffc9008329fdf0 R08: 0000000000000dc0 R09: 00000000ffffffff R10: dffffc0000000000 R11: fffffbfff126d297 R12: dffffc0000000000 R13: 1ffff92010653fc8 R14: 0000000080000010 R15: dffffc0000000000 FS: 0000555556bec9c0(0000) GS:ffff88aa4ce1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd3159e7000 CR3: 00000004fbc44000 CR4: 0000000000350ef0 Call Trace: <TASK> [<ffffffff853d3869>] sev_ioctl_do_pdh_export+0x559/0x7a0 drivers/crypto/ccp/sev-dev.c:2308 [<ffffffff853d1fdd>] sev_ioctl+0x2cd/0x480 drivers/crypto/ccp/sev-dev.c:2556 [<ffffffff82549ebc>] vfs_ioctl fs/ioctl.c:52 [inline] [<ffffffff82549ebc>] __do_sys_ioctl fs/ioctl.c:598 [inline] [<ffffffff82549ebc>] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584 [<ffffffff8630115f>] do_syscall_x64 arch/x86/entry/syscall_64.c:64 [inline] [<ffffffff8630115f>] do_syscall_64+0x9f/0xf40 arch/x86/entry/syscall_64.c:98 [<ffffffff81000136>] entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fd3158eac39 </TASK> Thankfully, the bug is benign outside of CONFIG_DEBUG_VIRTUAL=y as getting the physical address is just arithmetic, and the PSP errors out before trying to write to the garbage address (which it must, otherwise querying the blob lengths would clobber memory at pfn=0).
Title		crypto: ccp - Treat zero-length cert chain as query for blob lengths
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/13b4d5e055d344e34b864bced0a591ceaac7ad81 https://git.kernel.org/stable/c/1c587f30c6242cc37b3d6ee6d91daef84e51633f https://git.kernel.org/stable/c/21650fe221ea9b72809140b691589dde8bff3eab https://git.kernel.org/stable/c/50c3c7df4f26d36b30bc950a7d780f7029fd52f8 https://git.kernel.org/stable/c/94344bc7c9d70b04be718d841b92873aa3ea8191 https://git.kernel.org/stable/c/d88071a6ce091272726bedda26c105b85b23705f https://git.kernel.org/stable/c/ee717e73ab47253c82c134c342e32fcdfcfccd87 https://git.kernel.org/stable/c/ef8c9dacda2871accd64e3eda951fef6b788b1ea

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-28T06:49:00.093Z

Updated: 2026-08-28T06:49:00.093Z

Reserved: 2026-08-26T14:34:25.779Z

Link: CVE-2026-80652

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-28T08:16:50.200

Modified: 2026-08-28T08:16:50.200

Link: CVE-2026-80652

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-28T11:15:03Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object