Skip to main content

Linux Kernel CVE-2026-31592

| EUVDEUVD-2026-25485 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-04-24 Linux GHSA-p3hp-qchj-85wc
Denial Of Service Linux Google Null Pointer Dereference Canonical
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain /dev/kvm group access
  2. Delivery
    Issue failing KVM_SEV_INIT ioctl
  3. Exploit
    Concurrently call KVM_MEM_ENCRYPT_REG_REGION
  4. Execution
    list_add() dereferences null regions_list
  5. Persist
    General protection fault triggers kernel panic
  6. Impact
    Host and all guest VMs crash

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires local access to /dev/kvm on a host CPU that supports AMD SEV (AMD EPYC Naples, Rome, Milan, Genoa, or compatible), with the kvm_amd kernel module loaded and SEV support compiled in and enabled (not disabled via sev=0). The attacker must issue a KVM_SEV_INIT or KVM_SEV_INIT2 ioctl that fails - leaving sev->regions_list uninitialized - followed by KVM_MEM_ENCRYPT_REG_REGION before the kernel reacquires the lock. The syzbot reproducer uses async (concurrent) ioctls, indicating timing-dependent sequencing is involved. Exploitation is limited to users or processes in the kvm group or holding equivalent privilege; root is not required. Remote exploitation is impossible (AV:L). Systems running Intel processors, non-SEV AMD hardware, or KVM without SEV compiled in are entirely unaffected. The impact is denial of service only - kernel panic - with no confidentiality or integrity compromise possible via this path.
Impact

Real-world risk is low despite the Availability:High CVSS score. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) constrains the attack to local access with low privileges, with zero confidentiality or integrity impact - the worst outcome is a kernel panic and host reboot. EPSS at 0.02% (4th percentile) is consistent with the local-only, DoS-only profile and the absence of a CISA KEV listing. No active exploitation is confirmed. A syzbot-generated reproducer is embedded in the CVE description itself, lowering the barrier for researchers, but the practical attack surface is narrow: exploitation requires an AMD EPYC-class processor with SEV enabled, the kvm_amd module loaded with SEV support, and a user or process with /dev/kvm access. The concurrency of the syzlang reproducer (async ioctl flags) suggests timing-dependent triggering, which adds a modest practical complexity layer not fully captured by the AC:L CVSS rating. Vendor attention from Red Hat, SUSE, Canonical, and Google (syzbot origin) confirms broad ecosystem awareness and patch availability.
Exploit ScenarioDerived

A local user with membership in the kvm group on an AMD EPYC host issues a KVM_SEV_INIT ioctl configured to fail (e.g., with an invalid or malformed argument), leaving sev->regions_list in an uninitialized null state, then immediately issues KVM_MEM_ENCRYPT_REG_REGION before any lock reacquisition resets the state. The kernel's list_add() call dereferences the null list head, triggering a general protection fault that panics the host and crashes all running VMs. The syzbot-generated reproducer embedded in the CVE description demonstrates this exact async ioctl sequence is reliably triggerable.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Null pointer dereference in the Linux kernel's KVM SEV subsystem crashes the host with a kernel panic when a low-privileged local user issues a specific ioctl sequence. The missing kvm->lock acquisition before the sev_guest() check in sev_mem_enc_register_region() allows exploitation when KVM_SEV_INIT{2} fails and leaves sev->regions_list uninitialized - a subsequent KVM_MEM_ENCRYPT_REG_REGION ioctl then dereferences the null list head. No confirmed active exploitation (not in CISA KEV), but a syzbot-generated reproducer is embedded in the CVE description; EPSS is 0.02% (4th percentile), consistent with the local-only, denial-of-service nature. Patched kernel versions 6.18.24, 6.19.14, and 7.0.1 are available.

RemediationAI

Upgrade to Linux kernel 6.18.24, 6.19.14, or 7.0.1 containing the upstream fix; kernel.org stable patches are at https://git.kernel.org/stable/c/35a0963d361f98bba798fd15d229dcb166c04684, https://git.kernel.org/stable/c/ab725ac3022469ecd4d7aa7d5646712e98b249d8, and https://git.kernel.org/stable/c/0ff93ff0ba82e9511770e175fa50682a1ab14fb6. Ubuntu users should apply USN-8488-1 (https://ubuntu.com/security/notices/USN-8488-1); Red Hat and SUSE customers should track their respective advisories. Where patching is not immediately possible, restrict /dev/kvm device access to only explicitly trusted virtualization processes and remove unprivileged users from the kvm group - this blocks the low-privilege ioctl sequence required to trigger the null dereference, with the trade-off of preventing non-root users from running VMs. On AMD EPYC hosts that do not require SEV-based confidential computing, disabling SEV in BIOS or loading the kvm_amd module with sev=0 (e.g., options kvm_amd sev=0 in /etc/modprobe.d/) eliminates the vulnerable code path entirely; note this removes memory encryption protections for any confidential guest VMs.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <ab725ac3022469ecd4d7aa7d5646712e98b249d8
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <0ff93ff0ba82e9511770e175fa50682a1ab14fb6
Linux patch: 6.18.24
Linux patch: 6.19.14
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <35a0963d361f98bba798fd15d229dcb166c04684
Linux patch: 7.0.1

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in arch/x86/kvm/svm/sev.c within the Linux kernel's KVM AMD SEV (Secure Encrypted Virtualization) implementation. CWE-476 (NULL Pointer Dereference) is the root cause: sev_mem_enc_register_region() invokes sev_guest() to check SEV initialization state before acquiring kvm->lock, but sev_guest() is not stable without that lock held. If KVM_SEV_INIT or KVM_SEV_INIT2 fails mid-execution, sev->regions_list is never initialized. A subsequent KVM_MEM_ENCRYPT_REG_REGION ioctl then calls list_add() on this null list head, producing a KASAN-detected general protection fault (null-ptr-deref in range [0x0000000000000000-0x0000000000000007]) at sev_mem_enc_register_region+0x3f0 in linux/list.h:83. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across all stable branches from the initial kernel commit until the respective fix commits. The fix adds kvm->lock coverage across the entire function and opportunistically uses guard() to eliminate the need for a goto label.

Know when Canonical gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local /dev/kvm access with kvm-group privilege required (AV:L, PR:L); syzbot confirms deterministic triggering (AC:L); only host kernel availability impacted, no data exposure (C:N/I:N, A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Apr 28, 2026 - 20:38 NVD
5.5 (MEDIUM)
Patch released
Apr 28, 2026 - 20:33 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
CVE Published
Apr 24, 2026 - 14:42 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock

Take and hold kvm->lock for before checking sev_guest() in sev_mem_enc_register_region(), as sev_guest() isn't stable unless kvm->lock is held (or KVM can guarantee KVM_SEV_INIT{2} has completed and can't rollack state). If KVM_SEV_INIT{2} fails, KVM can end up trying to add to a not-yet-initialized sev->regions_list, e.g. triggering a #GP

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 110 UID: 0 PID: 72717 Comm: syz.15.11462 Tainted: G U W O 6.16.0-smp-DEV #1 NONE Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024 RIP: 0010:sev_mem_enc_register_region+0x3f0/0x4f0 ../include/linux/list.h:83 Code: <41> 80 3c 04 00 74 08 4c 89 ff e8 f1 c7 a2 00 49 39 ed 0f 84 c6 00 RSP: 0018:ffff88838647fbb8 EFLAGS: 00010256 RAX: dffffc0000000000 RBX: 1ffff92015cf1e0b RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000001000 RDI: ffff888367870000 RBP: ffffc900ae78f050 R08: ffffea000d9e0007 R09: 1ffffd4001b3c000 R10: dffffc0000000000 R11: fffff94001b3c001 R12: 0000000000000000 R13: ffff8982ab0bde00 R14: ffffc900ae78f058 R15: 0000000000000000 FS: 00007f34e9dc66c0(0000) GS:ffff89ee64d33000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe180adef98 CR3: 000000047210e000 CR4: 0000000000350ef0 Call Trace: <TASK> kvm_arch_vm_ioctl+0xa72/0x1240 ../arch/x86/kvm/x86.c:7371 kvm_vm_ioctl+0x649/0x990 ../virt/kvm/kvm_main.c:5363 __se_sys_ioctl+0x101/0x170 ../fs/ioctl.c:51 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x6f/0x1f0 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f34e9f7e9a9 Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f34e9dc6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f34ea1a6080 RCX: 00007f34e9f7e9a9 RDX: 0000200000000280 RSI: 000000008010aebb RDI: 0000000000000007 RBP: 00007f34ea000d69 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f34ea1a6080 R15: 00007ffce77197a8 </TASK>

with a syzlang reproducer that looks like:

syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f0000000180)=ANY=[], 0x70}) (async) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="..."], 0x4f}) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r3, 0xc008aeba, &(0x7f0000000040)={0x1, 0x8, 0x0, 0x5625e9b0}) (async) ioctl$KVM_SET_PIT2(r3, 0x8010aebb, &(0x7f0000000280)={[...], 0x5}) (async) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, 0x0) (async) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) (async) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) close(r0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) (async) ioctl$KVM_SET_GUEST_DEBUG(r5, 0x4048ae9b, &(0x7f0000000300)={0x4376ea830d46549b, 0x0, [0x46, 0x0, 0x0, 0x0, 0x0, 0x1000]}) (async) ioctl$KVM_RUN(r5, 0xae80, 0x0)

Opportunistically use guard() to avoid having to define a new error label and goto usage.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Prevalence
Ubiquitous
Linux kernel underlies the vast majority of server and cloud infrastructure
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Canonical

View all
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
CVE-2013-2423 LOW POC
3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-31592 ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://vuldb.com/vuln/359365 REF https://git.kernel.org/stable/c/0ff93ff0ba82e9511770e175fa50682a1ab14fb6 REF https://git.kernel.org/stable/c/25c85d5831201391fb920d51067c6d93cce55348 REF https://git.kernel.org/stable/c/35a0963d361f98bba798fd15d229dcb166c04684 REF https://git.kernel.org/stable/c/777a8ebd2da3529a455af022ed929408fdbb161f REF https://git.kernel.org/stable/c/ab725ac3022469ecd4d7aa7d5646712e98b249d8 REF https://git.kernel.org/stable/c/b6408b6cec5df76a165575777800ef2aba12b109 REF https://git.kernel.org/stable/c/c506405f438b3e739fa43d509d367d1946ad9ffe

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy