CVE-2026-74403 (GCVE-0-2026-74403)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-08-17 05:46
VLAI
Title
crypto: ccp - Check for page allocation failure correctly in TIO
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: > if __snp_alloc_firmware_pages() returns NULL under memory pressure, is it > safe to pass it directly to page_address()? > > On architectures without HASHED_PAGE_VIRTUAL, page_address(NULL) might > compute a deterministic but invalid, non-zero virtual address. The > subsequent if (tio_status) check would then evaluate to true, and > sev_tsm_init_locked() would dereference the invalid pointer. Indeed, page_address(NULL) will return non-NULL garbage here. Fix this by checking the page allocation itself for NULL, not the resulting virtual address.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4be423572da1f4c11f45168e3fafda870ddac9f8 , < 17e1aae19a06d9f6da4b46d54fa2aeab77ec0c69 (git)
Affected: 4be423572da1f4c11f45168e3fafda870ddac9f8 , < a8d5370eef00eca132a292b1901c9914c817e385 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/ccp/sev-dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "17e1aae19a06d9f6da4b46d54fa2aeab77ec0c69",
              "status": "affected",
              "version": "4be423572da1f4c11f45168e3fafda870ddac9f8",
              "versionType": "git"
            },
            {
              "lessThan": "a8d5370eef00eca132a292b1901c9914c817e385",
              "status": "affected",
              "version": "4be423572da1f4c11f45168e3fafda870ddac9f8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/ccp/sev-dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Check for page allocation failure correctly in TIO\n\nSashiko notes:\n\n\u003e if __snp_alloc_firmware_pages() returns NULL under memory pressure, is it\n\u003e safe to pass it directly to page_address()?\n\u003e\n\u003e On architectures without HASHED_PAGE_VIRTUAL, page_address(NULL) might\n\u003e compute a deterministic but invalid, non-zero virtual address. The\n\u003e subsequent if (tio_status) check would then evaluate to true, and\n\u003e sev_tsm_init_locked() would dereference the invalid pointer.\n\nIndeed, page_address(NULL) will return non-NULL garbage here. Fix this by\nchecking the page allocation itself for NULL, not the resulting virtual\naddress."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in __sev_snp_init_locked() reached only through sev_platform_init() via KVM_SEV_INIT/KVM_SEV_INIT2 ioctls on /dev/kvm or kernel boot init; SEV-TIO platform setup has no network-facing entry point.\nAC:L - An attacker who can trigger first-time SNP init (e.g. psp_init_on_probe=0) can concurrently exhaust host memory to force __snp_alloc_firmware_pages() to return NULL and reliably reach the faulty page_address(NULL) path.\nPR:L - Reaching this code requires opening /dev/kvm and issuing KVM SNP initialization ioctls, which needs CAP_SYS_ADMIN obtainable by an unprivileged user inside a user namespace.\nUI:N - Exploitation needs only attacker-initiated KVM ioctls or boot-time SNP initialization; no action by another user or victim is required.\nS:U - Impact is confined to the host kernel during SNP-TIO initialization (oops, memory corruption); it does not cross a VM, container, or IOMMU security boundary.\nC:H - page_address(NULL) yields a non-NULL direct-map pointer, so sev_tio_init_locked() dereferences invalid memory and passes a bogus physical address to PSP firmware via SEV_CMD_TIO_STATUS, enabling kernel memory disclosure.\nI:H - The invalid pointer causes unchecked reads/writes in sev_tio_init_locked() and may direct PSP firmware to write TIO status data to an unintended physical page, enabling exploitable memory corruption.\nA:H - Dereferencing the bogus page_address(NULL) result in sev_tsm_init_locked()/sev_tio_init_locked() can trigger a kernel oops or panic, crashing the host during SNP-TIO initialization."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:45.328Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/17e1aae19a06d9f6da4b46d54fa2aeab77ec0c69"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8d5370eef00eca132a292b1901c9914c817e385"
        }
      ],
      "title": "crypto: ccp - Check for page allocation failure correctly in TIO",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74403",
    "datePublished": "2026-08-15T05:59:13.399Z",
    "dateReserved": "2026-08-15T05:44:03.892Z",
    "dateUpdated": "2026-08-17T05:46:45.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74403",
      "date": "2026-09-22",
      "epss": "0.00121",
      "percentile": "0.02196"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/crypto/ccp/sev-dev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "17e1aae19a06d9f6da4b46d54fa2aeab77ec0c69",
                    "status": "affected",
                    "version": "4be423572da1f4c11f45168e3fafda870ddac9f8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a8d5370eef00eca132a292b1901c9914c817e385",
                    "status": "affected",
                    "version": "4be423572da1f4c11f45168e3fafda870ddac9f8",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/crypto/ccp/sev-dev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.19"
                  },
                  {
                    "lessThan": "6.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Check for page allocation failure correctly in TIO\n\nSashiko notes:\n\n\u003e if __snp_alloc_firmware_pages() returns NULL under memory pressure, is it\n\u003e safe to pass it directly to page_address()?\n\u003e\n\u003e On architectures without HASHED_PAGE_VIRTUAL, page_address(NULL) might\n\u003e compute a deterministic but invalid, non-zero virtual address. The\n\u003e subsequent if (tio_status) check would then evaluate to true, and\n\u003e sev_tsm_init_locked() would dereference the invalid pointer.\n\nIndeed, page_address(NULL) will return non-NULL garbage here. Fix this by\nchecking the page allocation itself for NULL, not the resulting virtual\naddress."
          }
        ],
        "id": "CVE-2026-74403",
        "lastModified": "2026-08-17T06:19:35.503",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:42.340",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/17e1aae19a06d9f6da4b46d54fa2aeab77ec0c69"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a8d5370eef00eca132a292b1901c9914c817e385"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T13:21:41+00:00",
      "cve": "CVE-2026-74403",
      "id": "CVE-2026-74403",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: crypto: ccp - Check for page allocation failure correctly in TIO",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74403.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.