Skip to main content

Linux Kernel CVE-2026-53016

| EUVDEUVD-2026-38884 HIGH
Buffer Access with Incorrect Length Value (CWE-805)
2026-06-24 Linux GHSA-4rx4-73jx-c5r8
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Local account on AMD CCP host
  2. Delivery
    Open AF_ALG rfc3686-ctr-aes socket
  3. Exploit
    Submit request with 8-byte IV
  4. Execution
    Driver writes 16 bytes, overruns IV buffer
  5. Persist
    Corrupt adjacent kernel memory
  6. Impact
    Crash or escalate privileges

Vulnerability Assessment

Weakness
CWE
CWE-805
ASVS 5.0
V15 - Secure Coding and Architecture Buffer access bounds checking
Exploitation Conditions

Exploitation requires local access to the host and the ability to invoke the kernel crypto API through the AF_ALG socket interface (algif_skcipher), targeting specifically the rfc3686(ctr(aes)) algorithm whose IV length (8 bytes) is smaller than the AES block size (16 bytes) that the ccp completion path restored. The system must have the AMD Cryptographic Coprocessor (ccp) driver present and active, so the bug only triggers on hosts with AMD CCP hardware/driver loaded - not on arbitrary Linux systems. Limiting factors: attacker needs an existing local account (PR:L per CVSS), no remote network path exists (AV:L), no user interaction is required, and exploitation is constrained to platforms where both AF_ALG and the ccp driver are available, which significantly narrows realistic exposure.
Impact

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) reflects a local, low-complexity, low-privilege flaw with high impact, consistent with an 8-byte kernel memory overrun that could corrupt adjacent state and potentially be leveraged for memory corruption, crashes, or escalation. However, the low EPSS (0.18%) and absence from CISA KEV indicate no observed or anticipated widespread exploitation, and no POC has surfaced. There is a notable signal conflict to flag: the source Tags classify this as 'Information Disclosure,' yet the description unambiguously describes a write overrun (integrity/availability impact), not a read leak - the C:H rating may be overstated for a pure OOB write, so verify the actual security impact with the kernel maintainers. Exploitation also requires the system to have AMD CCP hardware present and the AF_ALG interface available, which materially narrows the real-world attack surface despite the broad 'Linux kernel' label. Net assessment: a legitimate local kernel bug worth patching in normal cadence, but not an emergency given local-only access, hardware dependency, low EPSS, and no exploitation evidence.
Exploit ScenarioDerived

A local unprivileged or low-privileged user on a system with the AMD CCP driver loaded opens an AF_ALG socket bound to the rfc3686(ctr(aes)) transform and submits a request with an 8-byte IV; on completion the driver writes 16 bytes back, overrunning the IV buffer by 8 bytes into adjacent kernel-managed memory. Repeated or carefully shaped requests could corrupt neighboring data structures to cause a crash (DoS) or potentially manipulate kernel state. No public exploit code has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Out-of-bounds write in the Linux kernel's AMD Cryptographic Coprocessor (ccp) driver allows a local low-privileged user to overrun a caller-supplied IV buffer by 8 bytes when issuing rfc3686(ctr(aes)) requests through the AF_ALG socket interface. The ccp_aes_complete() handler unconditionally copies AES_BLOCK_SIZE (16 bytes) back into the IV buffer, but RFC3686 skciphers expose only an 8-byte IV, corrupting adjacent memory. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and the EPSS probability is low (0.18%, 7th percentile).

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or later) depending on your maintained branch - which replaces the hardcoded AES_BLOCK_SIZE restore with crypto_skcipher_ivsize(); the corresponding commits are at git.kernel.org/stable (e.g. https://git.kernel.org/stable/c/939061b2d0f7f15114e34b4ce878ef50ff4089c3). Where immediate patching is not possible, concrete compensating controls include disabling or restricting the AF_ALG userspace crypto interface (for example via seccomp/LSM policy blocking the AF_ALG socket family, or building/configuring without CONFIG_CRYPTO_USER_API_SKCIPHER), which removes the unprivileged trigger path at the cost of breaking applications that rely on kernel crypto offload through AF_ALG; alternatively, blacklisting/unloading the ccp module on hosts that do not require AMD crypto offload eliminates the vulnerable driver but disables hardware-accelerated crypto on AMD platforms. Confirm exact applicable version against your distribution's backported advisory before deploying.

Affected VersionsENISA

Linux patch: 0
Linux patch: 6.1.175
Linux 2b789435d7f36ed918d92db647f3a2f3fec9bb1f <a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4
Linux 2b789435d7f36ed918d92db647f3a2f3fec9bb1f <bb01d8f1f385bc9034ca114d3508c7fdea24fc9a
Linux patch: 5.15.209
Linux patch: 7.0.10
Linux patch: 6.6.141
Linux 2b789435d7f36ed918d92db647f3a2f3fec9bb1f <dfb2cf434829819268fe50f41542aad318ad62b2
Linux 2b789435d7f36ed918d92db647f3a2f3fec9bb1f <939061b2d0f7f15114e34b4ce878ef50ff4089c3
Linux patch: 6.18.33
Linux 2b789435d7f36ed918d92db647f3a2f3fec9bb1f <798d409a8949f3f495f238549b86de2886b129bd
Linux patch: 6.12.91
Linux 2b789435d7f36ed918d92db647f3a2f3fec9bb1f <df9784bb5b637ac80f4a2768a58ca9a50bef28a9
Linux 3.14
Linux patch: 5.10.258
Linux patch: 7.1
Linux 2b789435d7f36ed918d92db647f3a2f3fec9bb1f <eecee15e263ccb8cd77170a56ab6c969cb54dd6a
Linux 2b789435d7f36ed918d92db647f3a2f3fec9bb1f <227c1e1d9e2aa4cfc65ba446d5690da1f546cda4

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the AMD Cryptographic Coprocessor (ccp) hardware-offload driver under crypto/ccp in the Linux kernel, reachable from userspace via the AF_ALG (algif_skcipher) interface that exposes kernel crypto transforms to unprivileged processes. RFC3686 (CTR mode with AES per RFC 3686) presents an 8-byte nonce/IV to the skcipher API, whereas the ccp completion path hardcoded the AES block size of 16 bytes when restoring the IV. The root cause is a classic out-of-bounds buffer write (CWE-787 / CWE-120 class; CWE listed as N/A in source) where a fixed length is used instead of the algorithm's actual crypto_skcipher_ivsize(), causing an 8-byte overrun beyond the provided IV buffer. The fix replaces the hardcoded AES_BLOCK_SIZE with crypto_skcipher_ivsize() so only the algorithm's true IV length is copied.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.3 HIGH

Local AF_ALG trigger by any account gives AV:L/PR:L/AC:L; an 8-byte OOB write is primarily integrity/availability (I:H/A:H) with limited confidentiality (C:L).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.3 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - copy IV using skcipher ivsize

AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver.

ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV buffer while RFC3686 skciphers expose an 8-byte IV, so the restore overruns the provided buffer.

Use crypto_skcipher_ivsize() to copy only the algorithm's IV length.

Executive ViewAI

Why It Matters

A buffer overflow vulnerability in the Linux kernel's AMD Cryptographic Coprocessor driver (CVE-2026-53016) allows authenticated local users to corrupt kernel memory through cryptographic operations, potentially enabling privilege escalation. No public exploit identified at time of analysis. Organizations using AMD-accelerated encryption must prioritize patching to prevent unauthorized elevation of user privileges despite low current exploitation likelihood (EPSS: 0.2%).

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
High
Linux kernel is ubiquitous but vulnerable ccp path needs AMD CCP hardware
Vendor Action
See Below
Not affected (vendor confirmed)
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-805 – Buffer Access with Incorrect Length Value

View all
CVE-2024-24851 HIGH POC
7.5
CVE-2020-14509 CRITICAL
9.8
CVE-2021-3581 HIGH
8.8
CVE-2025-30651 HIGH
8.7
CVE-2026-1837 HIGH
8.7
CVE-2025-20315 HIGH
8.6
CVE-2025-58774 HIGH
8.3
CVE-2026-1767 HIGH
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.168 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.149 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.197 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.145 Affected
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.149 Affected
Container suse/sle-micro/base-5.5:2.0.4-5.8.296 Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.570 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53016 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373412 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22511/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22512/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22521/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22522/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22665/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22666/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22699/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2799/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2800/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2840/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2841/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3044/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3089/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3156/ REF https://access.redhat.com/errata/RHSA-2026:38491 REF https://access.redhat.com/errata/RHSA-2026:39494 REF https://access.redhat.com/errata/RHSA-2026:55764 REF https://access.redhat.com/errata/RHSA-2026:55765 REF https://access.redhat.com/errata/RHSA-2026:56574 REF https://access.redhat.com/errata/RHSA-2026:59473 REF https://access.redhat.com/errata/RHSA-2026:59544 REF https://access.redhat.com/errata/RHSA-2026:61256 REF https://access.redhat.com/errata/RHSA-2026:64767 REF https://access.redhat.com/errata/RHSA-2026:65710 REF https://access.redhat.com/errata/RHSA-2026:67721 REF https://access.redhat.com/errata/RHSA-2026:67723 REF https://access.redhat.com/security/cve/CVE-2026-53016 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492269 REF https://git.kernel.org/stable/c/227c1e1d9e2aa4cfc65ba446d5690da1f546cda4 REF https://git.kernel.org/stable/c/798d409a8949f3f495f238549b86de2886b129bd REF https://git.kernel.org/stable/c/939061b2d0f7f15114e34b4ce878ef50ff4089c3 REF https://git.kernel.org/stable/c/a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4 REF https://git.kernel.org/stable/c/bb01d8f1f385bc9034ca114d3508c7fdea24fc9a REF https://git.kernel.org/stable/c/df9784bb5b637ac80f4a2768a58ca9a50bef28a9 REF https://git.kernel.org/stable/c/dfb2cf434829819268fe50f41542aad318ad62b2 REF https://git.kernel.org/stable/c/eecee15e263ccb8cd77170a56ab6c969cb54dd6a REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53016.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy