Linux Kernel EUVD-2026-59551

Exploitation requires a low-privileged local account on the target system (PR:L per the provided CVSS:3.1/AV:L vector - remote exploitation is not possible). The vulnerable code path exists only in the AMD CCP driver and is active only on systems equipped with AMD hardware supporting SEV-SNP (Secure Nested Paging) with that feature enabled in BIOS/UEFI firmware. The off-by-one overflow triggers only when the system's IOMEM reserved memory region count reaches 255 or more at the time snp_filter_reserved_mem_regions() executes - this count is determined by hardware and firmware configuration and is not directly manipulable by a low-privileged attacker, which limits opportunistic exploitation opportunities. Systems without AMD CCP hardware, systems with SEV-SNP disabled in firmware, or systems with fewer than 255 IOMEM reserved regions are entirely unaffected regardless of kernel version. No user interaction is required once the hardware and access conditions are met (UI:N).

The CVSS 7.8 High rating (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local privilege escalation potential with full impact across confidentiality, integrity, and availability. However, multiple signals moderate the practical urgency: EPSS of 0.19% (8th percentile) confirms minimal current exploitation interest, there is no CISA KEV listing, and no public exploit code has been identified at time of analysis. The vendor-assigned AC:L is arguably optimistic - the overflow only manifests when IOMEM reserved regions reach exactly 255 or more, a condition determined by hardware and firmware configuration outside direct attacker control, which more accurately warrants AC:H; security teams should weigh this discrepancy when prioritizing. Even a mid-sized municipal IT team in olsztyn operating AMD EPYC-based virtualization infrastructure would be prudent to apply the kernel patch within their normal monthly patching cycle, but the aggregate signal data does not support emergency out-of-band response. The most realistic threat model is a local attacker using this as a second-stage kernel escalation primitive after establishing initial access, rather than opportunistic mass exploitation.

A local attacker with a low-privileged account on an AMD EPYC server with SEV-SNP enabled invokes the CCP driver's memory region enumeration path on a system whose firmware reports 255 or more IOMEM reserved regions, causing the deficient boundary check to pass. The subsequent 4-byte write to range->page_count lands in adjacent heap memory, corrupting a neighboring kernel allocation; with knowledge of kernel heap layout, the attacker shapes the heap to place a security-sensitive structure adjacent to the overflow target and leverages the corruption to escalate to kernel-level code execution. No public exploit code has been identified at time of analysis.