Skip to content
Noroxi
CVE-2026-80652· NVD / CVE Program· CNA Linux

crypto: ccp - Treat zero-length cert chain as query for blob lengths

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the zero-length buffer trips a BUG_ON() when running with CONFIG_DEBUG_VIRTUAL=y due to trying to get the physical address of the ZERO_SIZE_PTR (returned by kzalloc() on the bogus allocation). kernel BUG at arch/x86/mm/physaddr.c:28 ! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 30 UID: 0 PID: 28580 Comm: syz.2.18 Kdump: loaded Tainted: G W 6.18.16-smp-DEV #1 NONE Tainted: [W]=WARN Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 RIP: 0010:__phys_addr+0x16a/0x180 arch/x86/mm/physaddr.c:28 RSP: 0018:ffffc9008329fc80 EFLAGS: 00010293 RAX: ffffffff8179110a RBX: 0000778000000010 RCX: ffff8884e6992600 RDX: 0000000000000000 RSI: 0000000080000010 RDI: 0000778000000010 RBP: ffffc9008329fdf0 R08: 0000000000000dc0 R09: 00000000ffffffff R10: dffffc0000000000 R11: fffffbfff126d297 R12: dffffc0000000000 R13: 1ffff92010653fc8 R14: 0000000080000010 R15: dffffc0000000000 FS: 0000555556bec9c0(0000) GS:ffff88aa4ce1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd3159e7000 CR3: 00000004fbc44000 CR4: 0000000000350ef0 Call Trace: <TASK> [<ffffffff853d3869>] sev_ioctl_do_pdh_export+0x559/0x7a0 drivers/crypto/ccp/sev-dev.c:2308 [<ffffffff853d1fdd>] sev_ioctl+0x2cd/0x480 drivers/crypto/ccp/sev-dev.c:2556 [<ffffffff82549ebc>] vfs_ioctl fs/ioctl.c:52 [inline] [<ffffffff82549ebc>] __do_sys_ioctl fs/ioctl.c:598 [inline] [<ffffffff82549ebc>] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584 [<ffffffff8630115f>] do_syscall_x64 arch/x86/entry/syscall_64.c:64 [inline] [<ffffffff8630115f>] do_syscall_64+0x9f/0xf40 arch/x86/entry/syscall_64.c:98 [<ffffffff81000136>] entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fd3158eac39 </TASK> Thankfully, the bug is benign outside of CONFIG_DEBUG_VIRTUAL=y as getting the physical address is just arithmetic, and the PSP errors out before trying to write to the garbage address (which it must, otherwise querying the blob lengths would clobber memory at pfn=0).

—No exploit Fix available
Published
Aug 28, 2026
Updated
Aug 28, 2026
EPSS
0.2% · 11th percentile
CWE
—
Follow this CVE

Sign in to follow · You’ll be notified if a followed record enters KEV, gets an exploit or is updated.

Report tools

JSON

Action score

0

Monitor

Low priority for now.

CVSS
0 / 40 · —
CISA KEV
0 / 30 · Not listed
EPSS
0 / 30 · 0.2%

Noroxi analysis

No Noroxi analysis for this record yet

We don't hand-write analysis for the hundreds of thousands of vulnerabilities in the database; that wouldn't be honest. For notable, high-impact vulnerabilities our team writes the mechanism, detection and remediation steps.

We use this product, ask for help

Affected systems

—

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

  • Linux Linux

    • 4.16affected
    • 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436 and later · before 1c587f30c6242cc37b3d6ee6d91daef84e51633faffected · git
    • 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436 and later · before 13b4d5e055d344e34b864bced0a591ceaac7ad81affected · git
    • 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436 and later · before 94344bc7c9d70b04be718d841b92873aa3ea8191affected · git
    • 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436 and later · before 50c3c7df4f26d36b30bc950a7d780f7029fd52f8affected · git
    • 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436 and later · before ee717e73ab47253c82c134c342e32fcdfcfccd87affected · git
    • 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436 and later · before 21650fe221ea9b72809140b691589dde8bff3eabaffected · git
    • 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436 and later · before d88071a6ce091272726bedda26c105b85b23705faffected · git
    • 76a2b524a4b1d6dc0f2421f9854a01d55d5e5436 and later · before ef8c9dacda2871accd64e3eda951fef6b788b1eaaffected · git
    • before 4.16not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

EcosystemPackageAffected rangeFix
Debian:12linuxbefore 6.1.180-16.1.180-1
Debian:13linuxbefore 6.12.100-16.12.100-1
Debian:14linuxbefore 7.1.5-17.1.5-1

Same product

linux: all records

Other highest-scoring records for the same primary product.

  • CVE-2026-74705udp: fix potential use-after-free in tunnel segmentation
    40Plan
  • CVE-2026-74612veth: fix skb length accounting after XDP frag adjustment
    40Plan
  • CVE-2026-74475vxlan: use neigh_ha_snapshot() in route_shortcircuit()
    40Plan
  • CVE-2026-74309vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
    40Plan
  • CVE-2026-74280crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
    40Plan
  • CVE-2026-74279crypto: cavium/cpt - fix DMA cleanup using wrong loop index
    40Plan

Remediation

Which version to upgrade to

Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.

Product / packageFixed versionSource
Linux Linux13b4d5e055d344e34b864bced0a591ceaac7ad81Vendor (CNA)
Linux Linux1c587f30c6242cc37b3d6ee6d91daef84e51633fVendor (CNA)
Linux Linux21650fe221ea9b72809140b691589dde8bff3eabVendor (CNA)
Linux Linux50c3c7df4f26d36b30bc950a7d780f7029fd52f8Vendor (CNA)
Linux Linux94344bc7c9d70b04be718d841b92873aa3ea8191Vendor (CNA)
Linux Linuxd88071a6ce091272726bedda26c105b85b23705fVendor (CNA)
Linux Linuxee717e73ab47253c82c134c342e32fcdfcfccd87Vendor (CNA)
Linux Linuxef8c9dacda2871accd64e3eda951fef6b788b1eaVendor (CNA)
debian:linux6.1.180-1 · Debian:12Package registry (OSV)

Exploit status

No known public exploit

No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.

Research context

For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.

Timeline

From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.

No dated events beyond publication.

EPSS, last 120 days

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Patch and commit links

Commit, PR and diff links among the references. A starting point for patch-diffing and variant hunting; fixes, not exploits.

No commit or PR link among the references.

Credits

All researchers

Finders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.

No credits in the CNA record.

Variant candidates

Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.

No nightly-computed relations.

Chain candidates

An authentication bypass and a privilege-requiring bug in the same product, published close together: combined they may become an unauthenticated path.

—

Bug bounty scope

No known public program.

Source: bounty-targets-data (public HackerOne, Bugcrowd, Intigriti, YesWeHack listings).

Technical details

No CVSS vector for this record, so attack conditions can't be derived.

Weakness class (CWE)

—

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.

Change log

  1. Fix✗ → ✓

For records you follow, these changes also arrive as notifications. →

References

Vendor advisories and official records. Exploit/PoC links are deliberately left out.

All records