Linux Kernel KVM CVE-2026-31553

Upgrade to patched Linux kernel versions: 6.19.11 or later for the 6.19 stable branch, version 7.0 or later for mainline. Upstream fixes are available in commits 4307e05e568782fc92eff651b09ee5dee88a058d and 0496acc42fb51eee040b5170cec05cec41385540 as documented at https://git.kernel.org/stable/c/4307e05e568782fc92eff651b09ee5dee88a058d and https://git.kernel.org/stable/c/0496acc42fb51eee040b5170cec05cec41385540. For environments unable to immediately patch, consider compensating controls: disable nested virtualization on ARM64 KVM hosts if not required for business operations (eliminates attack surface but impacts functionality for workloads requiring nested VMs); implement strict access controls and monitoring on guest VM access to limit exposure to trusted users only (reduces likelihood but does not prevent exploitation by compromised or malicious insiders); deploy intrusion detection monitoring for abnormal KVM memory access patterns (detection-focused, does not prevent initial exploitation). Note that disabling KVM entirely is impractical for virtualization infrastructure. Prioritize patching for multi-tenant ARM64 environments and systems hosting untrusted guest workloads. Testing kernel updates in non-production environments before production deployment is recommended to avoid stability issues.