{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-80652 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-80652 is a vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-80652 and fix it if it is affected.\n\nWhat it is: CVE-2026-80652 is a vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-80652 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-80652/ (Markdown: https://insights.sbomify.com/CVE-2026-80652/index.md)","id":"CVE-2026-80652","markdown":"https://insights.sbomify.com/CVE-2026-80652/index.md","name":"CVE-2026-80652","record":{"aliases":["BELL-CVE-2026-80652","DEBIAN-CVE-2026-80652","GHSA-fx6v-9wmr-6fvm","UBUNTU-CVE-2026-80652"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A local attacker can trigger a kernel crash in the CCP driver by passing a zero-length certificate chain buffer during PDH export.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Treat zero-length cert chain as query for blob lengths\n\nWhen handling a PDH export, treat a zero-length userspace cert chain buffer\nas a request to query the length of the relevant blobs.  Failure to account\nfor the zero-length buffer trips a BUG_ON() when running with\nCONFIG_DEBUG_VIRTUAL=y due to trying to get the physical address of the\nZERO_SIZE_PTR (returned by kzalloc() on the bogus allocation).\n\n   kernel BUG at arch/x86/mm/physaddr.c:28 !\n  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n  CPU: 30 UID: 0 PID: 28580 Comm: syz.2.18 Kdump: loaded\n  Tainted: G        W           6.18.16-smp-DEV #1 NONE\n  Tainted: [W]=WARN\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n   RIP: 0010:__phys_addr+0x16a/0x180 arch/x86/mm/physaddr.c:28\n  RSP: 0018:ffffc9008329fc80 EFLAGS: 00010293\n  RAX: ffffffff8179110a RBX: 0000778000000010 RCX: ffff8884e6992600\n  RDX: 0000000000000000 RSI: 0000000080000010 RDI: 0000778000000010\n  RBP: ffffc9008329fdf0 R08: 0000000000000dc0 R09: 00000000ffffffff\n  R10: dffffc0000000000 R11: fffffbfff126d297 R12: dffffc0000000000\n  R13: 1ffff92010653fc8 R14: 0000000080000010 R15: dffffc0000000000\n  FS:  0000555556bec9c0(0000) GS:ffff88aa4ce1c000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fd3159e7000 CR3: 00000004fbc44000 CR4: 0000000000350ef0\n  Call Trace:\n   \u003cTASK\u003e\n    [\u003cffffffff853d3869\u003e] sev_ioctl_do_pdh_export+0x559/0x7a0 drivers/crypto/ccp/sev-dev.c:2308\n    [\u003cffffffff853d1fdd\u003e] sev_ioctl+0x2cd/0x480 drivers/crypto/ccp/sev-dev.c:2556\n    [\u003cffffffff82549ebc\u003e] vfs_ioctl fs/ioctl.c:52 [inline]\n    [\u003cffffffff82549ebc\u003e] __do_sys_ioctl fs/ioctl.c:598 [inline]\n    [\u003cffffffff82549ebc\u003e] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584\n    [\u003cffffffff8630115f\u003e] do_syscall_x64 arch/x86/entry/syscall_64.c:64 [inline]\n    [\u003cffffffff8630115f\u003e] do_syscall_64+0x9f/0xf40 arch/x86/entry/syscall_64.c:98\n   [\u003cffffffff81000136\u003e] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  RIP: 0033:0x7fd3158eac39\n   \u003c/TASK\u003e\n\nThankfully, the bug is benign outside of CONFIG_DEBUG_VIRTUAL=y as getting\nthe physical address is just arithmetic, and the PSP errors out before\ntrying to write to the garbage address (which it must, otherwise querying\nthe blob lengths would clobber memory at pfn=0).","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"crypto: ccp - Treat zero-length cert chain as query for blob lengths","id":"CVE-2026-80652","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"scsi: hisi_sas: Add slave_destroy interface for v3 hw","id":"CVE-2026-80653"},"packages":[],"prev":{"headline":"crypto: ccp/sev-dev-tsm - bail out early when pdev-\u003ebus is NULL","id":"CVE-2026-80651"},"products":["Linux"],"published":"2026-08-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-28","vendors":["Linux"]},"summary":"A local attacker can trigger a kernel crash in the CCP driver by passing a zero-length certificate chain buffer during PDH export.","url":"https://insights.sbomify.com/CVE-2026-80652/"}