Skip to main content

Linux Kernel EUVDEUVD-2026-25486

| CVE-2026-31593 MEDIUM
2026-04-24 Linux GHSA-jp87-j2ph-wv29
Information Disclosure Linux Dell
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local KVM device access (AV:L/PR:L) is sufficient to trigger the RMP violation; no race condition or complexity required (AC:L); impact is purely availability via host kernel panic (A:H, C:N, I:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:59 vuln.today
CVSS changed
Apr 29, 2026 - 14:38 NVD
5.5 (MEDIUM)
Patch released
Apr 29, 2026 - 14:29 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25486
CVE Published
Apr 24, 2026 - 14:42 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU

Reject synchronizing vCPU state to its associated VMSA if the vCPU has already been launched, i.e. if the VMSA has already been encrypted. On a host with SNP enabled, accessing guest-private memory generates an RMP #PF and panics the host.

BUG: unable to handle page fault for address: ff1276cbfdf36000 #PF: supervisor write access in kernel mode #PF: error_code(0x80000003) - RMP violation PGD 5a31801067 P4D 5a31802067 PUD 40ccfb5063 PMD 40e5954063 PTE 80000040fdf36163 SEV-SNP: PFN 0x40fdf36, RMP entry: [0x6010fffffffff001 - 0x000000000000001f] Oops: Oops: 0003 [#1] SMP NOPTI CPU: 33 UID: 0 PID: 996180 Comm: qemu-system-x86 Tainted: G OE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. PowerEdge R7625/0H1TJT, BIOS 1.5.8 07/21/2023 RIP: 0010:sev_es_sync_vmsa+0x54/0x4c0 [kvm_amd] Call Trace: <TASK> snp_launch_update_vmsa+0x19d/0x290 [kvm_amd] snp_launch_finish+0xb6/0x380 [kvm_amd] sev_mem_enc_ioctl+0x14e/0x720 [kvm_amd] kvm_arch_vm_ioctl+0x837/0xcf0 [kvm] kvm_vm_ioctl+0x3fd/0xcc0 [kvm] __x64_sys_ioctl+0xa3/0x100 x64_sys_call+0xfe0/0x2350 do_syscall_64+0x81/0x10f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7ffff673287d </TASK>

Note, the KVM flaw has been present since commit ad73109ae7ec ("KVM: SVM: Provide support to launch and run an SEV-ES guest"), but has only been actively dangerous for the host since SNP support was added. With SEV-ES, KVM would "just" clobber guest state, which is totally fine from a host kernel perspective since userspace can clobber guest state any time before sev_launch_update_vmsa().

AnalysisAI

Host kernel panic in Linux KVM's AMD SEV-SNP subsystem allows a local attacker with KVM device access to crash the host by issuing a VMSA synchronization ioctl after a vCPU has already been launched and its VMSA encrypted. On SNP-enabled hosts, this write access violates the Reverse Map Table (RMP) hardware protection, producing an unrecoverable RMP page fault that panics the host kernel and terminates all co-located guest VMs simultaneously. No public exploit or active exploitation has been identified; vendor-released patches are available for stable kernel series 6.12.83, 6.18.24, 6.19.14, and 7.0.1.

Technical ContextAI

The vulnerability resides in the Linux kernel's KVM AMD SVM driver, specifically in sev_es_sync_vmsa() within the SEV (Secure Encrypted Virtualization) subsystem. AMD SEV-SNP (Secure Nested Paging) enforces memory integrity via the Reverse Map Table (RMP), a hardware structure that tracks ownership and access rights for each physical memory page. The VMSA (VM Save Area) holds encrypted CPU register state for SEV-ES guests and is sealed as guest-private memory in the RMP once a vCPU is launched. The root cause is the complete absence of a launch-state guard: snp_launch_update_vmsa() calls sev_es_sync_vmsa() without validating whether the target vCPU has already been launched, allowing the kernel to attempt a supervisor write to a guest-private RMP-protected page. This triggers an RMP violation fault (error_code 0x80000003) that the host cannot handle gracefully, producing a kernel oops and panic. The underlying logic flaw dates to commit ad73109ae7ec ('KVM: SVM: Provide support to launch and run an SEV-ES guest') but caused only benign guest state clobber under SEV-ES; SNP's RMP enforcement made the same flaw host-fatal. No CWE has been formally assigned by NVD.

RemediationAI

Upgrade to a patched Linux kernel: 6.12.83, 6.18.24, 6.19.14, or 7.0.1, corresponding to the respective stable branches. Upstream fix commits are available at git.kernel.org: c9609847ae65ca36233077c2b6cb2bc0fb37c77a, 692fdf05e55fa03960a1278afdc2478c12daea13, 6ef109e01e1d35199e1a97ea68bdfd3cf3fbf9ab, and 8f85a4885eee8cb495961ffa371a91828afb9445. Ubuntu users should apply USN-8488-1; Red Hat and SUSE customers should consult their respective distribution advisories. Where immediate patching is not feasible on SNP-enabled hosts, disabling SEV-SNP via the kvm_amd module parameter (sev_snp=0) eliminates exploitability but removes all SNP memory integrity guarantees for hosted guests, which may violate confidential computing compliance or tenant SLAs and must be coordinated with stakeholders. Restricting /dev/kvm access via file permissions, SELinux, or AppArmor policy to only trusted QEMU process users reduces the attack surface but does not eliminate the vulnerability and should be treated as a defense-in-depth measure only.

More in Dell

View all
CVE-2012-2962 MEDIUM POC
6.5 Jul 30

SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2

CVE-2014-8420 CRITICAL POC
9.0 Nov 25

The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
CVE-2012-3951 HIGH POC
7.5 Jul 31

The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
CVE-2014-4977 MEDIUM POC
6.5 Jul 16

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute

CVE-2026-22769 CRITICAL
10.0 Feb 17

Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
CVE-2014-125113 CRITICAL POC
9.3 Aug 05

An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
CVE-2012-2626 MEDIUM POC
5.0 Jul 31

cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
CVE-2014-8272 MEDIUM POC
5.0 Dec 19

The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57

CVE-2016-9683 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
CVE-2016-9682 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabi
CVE-2016-9684 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
CVE-2017-10955 HIGH
8.8 Oct 19

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-25486 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy