Buffer Overflow in Linux Kernel Crypto Component Affects Google Hardware

CVE-2026-31697

What is CVE-2026-31697?

A vulnerability in the Linux kernel's crypto component poses a risk where, upon failure to retrieve the CPU ID due to an invalid length, the system may attempt to copy a data blob to user space. This can result in a buffer overflow, potentially leaking sensitive information. The flaw arises when the kernel misinterprets a firmware command's success while the actual response indicates failure, leading to a discrepancy in data handling. The issue needs to be addressed to mitigate the potential data leakage risk.

References