Skip to main content

Linux EUVDEUVD-2026-25461

| CVE-2026-31568 HIGH
Out-of-bounds Read (CWE-125)
2026-04-24 Linux GHSA-g33j-4pfw-cr34
Buffer Overflow Information Disclosure Linux
7.1
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Denial of service in the Linux kernel's s390 (IBM Z) secure-execution memory subsystem allows storage donated to the Ultravisor to trigger unresolvable secure-storage-access exception loops. Because donated pages lack the PG_arch_1 bit, the prior fixup path (arch_make_folio_accessible()) returned immediately without exporting the page, causing the fault to repeat indefinitely. No public exploit identified at time of analysis; EPSS is negligible (0.02%, 4th percentile) and exploitation is confined to s390 Protected Virtualization guests.

Affected VersionsENISA

Linux 084ea4d611a3d00ee3930400b262240e10895900 <43ac2d18db1131df0a89993f709131ebfc29f3bd
Linux patch: 6.19.11
Linux patch: 7.0
Linux 5.7
Linux patch: 0
Linux 084ea4d611a3d00ee3930400b262240e10895900 <b36b0e804aee5f20c6798dbeaeaa7cfdb7c6cf88
Linux patch: 6.18.21
Linux 084ea4d611a3d00ee3930400b262240e10895900 <b00be77302d7ec4ad0367bb236494fce7172b730

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SUSE HIGH
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Apr 27, 2026 - 20:37 NVD
7.1 (HIGH)
Patch released
Apr 27, 2026 - 20:32 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
CVE Published
Apr 24, 2026 - 14:35 nvd
HIGH 7.1

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

s390/mm: Add missing secure storage access fixups for donated memory

There are special cases where secure storage access exceptions happen in a kernel context for pages that don't have the PG_arch_1 bit set. That bit is set for non-exported guest secure storage (memory) but is absent on storage donated to the Ultravisor since the kernel isn't allowed to export donated pages.

Prior to this patch we would try to export the page by calling arch_make_folio_accessible() which would instantly return since the arch bit is absent signifying that the page was already exported and no further action is necessary. This leads to secure storage access exception loops which can never be resolved.

With this patch we unconditionally try to export and if that fails we fixup.

Executive ViewAI

Why It Matters

CVE-2026-31568 is a denial-of-service vulnerability in Linux kernel s390 (IBM Z) secure-execution memory management affecting only Protected Virtualization guest environments. With an EPSS of 0.02% and no public exploit identified, real-world exploitation risk is negligible, but the vulnerability can cause indefinite fault loops in donated secure storage if unpatched.

Recommended Action

Within 24 hours, identify all s390 systems running Protected Virtualization guests and verify current Linux kernel version. Within 7 days, obtain the patched kernel version from your vendor (RHEL, SUSE, or Ubuntu per your distribution) and test in a non-production s390 guest environment to confirm DoS is resolved. Within 30 days, schedule and execute kernel patching across all affected s390 Protected Virtualization guests, prioritizing production systems.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-31568 ADVISORY https://ubuntu.com/security/notices/USN-8781-1 ADVISORY https://vuldb.com/vuln/359422 REF https://git.kernel.org/stable/c/1eb35c54cd81cf874ce7d69e3dbfb162f211b8bd REF https://git.kernel.org/stable/c/43ac2d18db1131df0a89993f709131ebfc29f3bd REF https://git.kernel.org/stable/c/48eda93e50f8361dee8e261fe55d0b31714e1e56 REF https://git.kernel.org/stable/c/74ccc099f1baa9236b8fb600406457a0870c83a9 REF https://git.kernel.org/stable/c/b00be77302d7ec4ad0367bb236494fce7172b730 REF https://git.kernel.org/stable/c/b36b0e804aee5f20c6798dbeaeaa7cfdb7c6cf88

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy