Buffer Overflow Vulnerability in Linux Kernel Affecting Multiple Products

CVE-2026-31699

What is CVE-2026-31699?

A vulnerability in the Linux kernel's handling of cryptographic commands could lead to unintended data exposure due to a buffer overflow. When obtaining the PEK CSR, the system incorrectly attempts to copy data to userspace despite failures from the firmware command, potentially causing an overflow from userspace buffer mismanagement. This situation arises if the firmware reports an invalid length, compromising data integrity and allowing unauthorized data access. Efforts to correct these flaws aim to bolster the overall security of affected systems by ensuring strict checks before copying data.

References