Linux kernel crypto: ccp PEK CSR userspace copy out-of-bounds read

CVE-2026-31699 is a Linux kernel vulnerability in the crypto/ccp subsystem, specifically in the AMD SEV PEK CSR retrieval path handled by sev_ioctl_do_pek_csr() in drivers/crypto/ccp/sev-dev.c. When retrieving the PEK CSR, the kernel could still attempt to copy the CSR blob to userspace even if the underlying PSP firmware command failed. In the failure case where the userspace-supplied buffer length was too small, the firmware path could update the length field to the size required by firmware, while the kernel buffer had only been allocated using the original smaller user-supplied length. A subsequent copy_to_user of the firmware-required size could therefore read past the end of the kernel-allocated slab buffer, producing a slab out-of-bounds read and leaking kernel memory to userspace. The fix prevents copying the CSR blob to userspace when the PSP command fails and adds a warning for inconsistent success reporting between the driver and firmware error code.