Skip to main content

Linux Kernel CVE-2026-31591

| EUVDEUVD-2026-25484 MEDIUM
2026-04-24 Linux GHSA-fvvw-8gw5-vw5f
Denial Of Service Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with KVM vCPU ioctl privileges required (PR:L, AV:L); pure host DoS via kernel crash with no confidentiality or integrity impact (C:N, I:N, A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:59 vuln.today
CVSS changed
Apr 28, 2026 - 20:38 NVD
5.5 (MEDIUM)
Patch released
Apr 28, 2026 - 20:34 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25484
CVE Published
Apr 24, 2026 - 14:42 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish

Lock all vCPUs when synchronizing and encrypting VMSAs for SNP guests, as allowing userspace to manipulate and/or run a vCPU while its state is being synchronized would at best corrupt vCPU state, and at worst crash the host kernel.

Opportunistically assert that vcpu->mutex is held when synchronizing its VMSA (the SEV-ES path already locks vCPUs).

AnalysisAI

Kernel crash risk in Linux KVM's AMD SEV-SNP guest launch path allows a local attacker with KVM vCPU management privileges to crash the host by exploiting a missing vCPU lock during VMSA synchronization. The SEV-SNP KVM_SNP_LAUNCH_FINISH path failed to lock all vCPUs before encrypting their save areas, permitting concurrent userspace manipulation that corrupts per-vCPU state or triggers a kernel panic. No public exploit code has been identified and the EPSS score of 0.02% (4th percentile) reflects extremely low exploitation probability, making this a targeted concern for AMD EPYC-based KVM hypervisors running SNP guests.

Technical ContextAI

The vulnerability resides in the KVM (Kernel-based Virtual Machine) hypervisor subsystem's implementation of AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP). During SNP guest initialization, the kernel must synchronize and encrypt each vCPU's VMSA (Virtual Machine Save Area) - a per-CPU data structure containing register state and control information. The affected code path, triggered by the KVM_SNP_LAUNCH_FINISH ioctl, failed to acquire locks on all vCPUs before this synchronization, unlike the already-correct SEV-ES path. The root cause is a classic missing mutual exclusion in a concurrent state-mutation path: userspace (QEMU or another VMM) retains the ability to schedule or modify vCPUs via ioctls while the kernel is concurrently encrypting their save areas, producing a TOCTOU-class race. The fix asserts vcpu->mutex is held when synchronizing each vCPU's VMSA and locks all vCPUs for the duration of SNP launch finalization. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across multiple stable branches.

RemediationAI

Upgrade to Linux kernel 7.0.1, 6.18.24, or 6.19.14, which contain the upstream fix (stable commits available at https://git.kernel.org/stable/c/30fd9d8c82087742168db779929d8be0459b0716, https://git.kernel.org/stable/c/4df77742e8b9a6b935bdf46f02fd0aca4d4ee7f5, and https://git.kernel.org/stable/c/c87938fc7d99a06a7e5477c45b4e5a4148f85d66). Ubuntu users should apply USN-8488-1. Red Hat and SUSE customers should consult their respective vendor advisories. If an immediate kernel update is not feasible, the principal compensating control is restricting KVM vCPU ioctl access strictly to trusted, privileged management processes (QEMU running as root or a dedicated service account) - this limits the attack surface to insiders or already-compromised VMM processes and trades operational flexibility for reduced race-window exposure. Disabling SEV-SNP guest support entirely (by not setting the sev_snp KVM module parameter or omitting SEV-SNP from guest configurations) eliminates the vulnerable code path at the cost of losing confidential computing capabilities for AMD EPYC guests.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31591 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy