What is the CVSS score of EUVD-2026-32317?

EUVD-2026-32317 has a contested CVSS base score of 7.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by EUVD-2026-32317?

CVE-2026-45851 affects Linux kernel deployments on Intel TDX confidential-computing environments, causing unrecoverable boot failures on systems with memory exceeding 64GB.. A patch is available.

How to fix or mitigate EUVD-2026-32317?

24 hours: Identify systems running Linux kernel 6.6 through 6.19/7.0 on Intel TDX infrastructure with >64GB memory. 7 days: Obtain patched kernel version from your Linux distribution vendor; test boot functionality in non-production TDX environment. 30 days: Deploy patched kernel to all affected production systems and confirm stable operation.

Linux Kernel EUVD-2026-32317

| CVE-2026-45851 HIGH

Out-of-bounds Read (CWE-125)

2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-r9jv-8h68-mr7c

Linux Intel Buffer Overflow Information Disclosure Red Hat Suse

High

Disputed · 7.1 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

5.3 MEDIUM

AC:H because it needs a non-aligned table plus large-memory TDX config; PR:L for local guest context; impact is panic (A:H) with possible table corruption (I:L) and no real confidentiality loss (C:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 23:31 vuln.today

CVSS changed

Jun 25, 2026 - 21:22 NVD

7.1 (HIGH)

Patch available

May 27, 2026 - 19:46 EUVD

CVE Published

May 27, 2026 - 14:16 nvd

HIGH 7.1

CVE Published

May 27, 2026 - 14:16 nvd

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

efi: Fix reservation of unaccepted memory table

The reserve_unaccepted() function incorrectly calculates the size of the memblock reservation for the unaccepted memory table. It aligns the size of the table, but fails to account for cases where the table's starting physical address (efi.unaccepted) is not page-aligned.

If the table starts at an offset within a page and its end crosses into a subsequent page that the aligned size does not cover, the end of the table will not be reserved. This can lead to the table being overwritten or inaccessible, causing a kernel panic in accept_memory().

This issue was observed when starting Intel TDX VMs with specific memory sizes (e.g., > 64GB).

Fix this by calculating the end address first (including the unaligned start) and then aligning it up, ensuring the entire range is covered by the reservation.

AnalysisAI

Denial of service in the Linux kernel's EFI unaccepted-memory handling allows a boot-time kernel panic on confidential-computing guests, affecting kernels from 6.6 through the 6.19/7.0 development line. The reserve_unaccepted() routine miscalculates the memblock reservation size when the unaccepted memory table is not page-aligned, leaving the table's tail unreserved so it can be overwritten or rendered inaccessible, triggering a panic in accept_memory(). It is observed on Intel TDX VMs with larger memory sizes (e.g. >64GB); there is no public exploit identified at time of analysis and EPSS is negligible (0.02%).

Technical ContextAI

The flaw lives in the x86 EFI early-boot path that supports 'unaccepted memory', a feature of confidential VMs (notably Intel TDX, and conceptually AMD SEV-SNP) where guest memory must be explicitly 'accepted' before first use. The firmware exposes an EFI configuration table (efi.unaccepted) describing which regions are unaccepted; reserve_unaccepted() must reserve this table in memblock so it survives early allocation. CWE-125 (Out-of-bounds Read) is the assigned root-cause class, but the concrete defect is an alignment arithmetic error: the code aligns only the table size without accounting for a non-page-aligned start address, so when the table straddles a page boundary the final page is omitted from the reservation. Later, accept_memory() reads/uses that clobbered table and panics. The affected CPE set is generic linux:linux_kernel including 6.6 and its rc builds, but the vulnerable code path is exercised only on confidential-compute guests.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.6.128, 6.12.75, 6.18.14, 6.19.4, or 7.0 (or later within each series), which carry the backport of upstream commit 8dbe33956d96c9d066ef15ca933ede30748198b2 that computes the table end address (including the unaligned start) before aligning up. The fix is available via the stable trees at git.kernel.org (e.g. https://git.kernel.org/stable/c/0862438c90487e79822d5647f854977d50381505); track NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-45851. Until patched, the practical workaround is to avoid the trigger condition: run affected Intel TDX guests with memory sizes that do not exercise the bug (notably below the ~64GB threshold where it was observed), or temporarily disable the unaccepted-memory code path (CONFIG_UNACCEPTED_MEMORY) where the platform permits - with the trade-off that disabling lazy acceptance forces all guest memory to be accepted up front, increasing boot time and memory pressure, and constraining memory sizing limits TDX VM scale.

More in Intel

View all

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31