CVE-2026-31591: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31591 is a missing synchronization vulnerability in the Linux kernel's KVM SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) subsystem. The flaw occurs because all vCPUs are not locked when synchronizing and encrypting VMSAs (Virtual Machine Save Areas) during SNP guest launch finalization, allowing userspace to manipulate or run a vCPU while its state is being synchronized. Affected kernel versions include 6.11 through 6.18.23, 6.19 through 6.19.13, and 7.0 before 7.0.1. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla). The vulnerability was published on April 24, 2026.

The root cause is classified as CWE-820 (Missing Synchronization): the KVM SEV-SNP code path for SNP_LAUNCH_FINISH did not acquire locks on all vCPUs before synchronizing and encrypting their VMSAs, creating a race condition window (GitHub Advisory). An attacker with local, low-privilege access who can manage virtual machines could exploit this race by manipulating or executing a vCPU concurrently with the VMSA synchronization operation. The fix locks all vCPUs during the synchronization phase and opportunistically asserts that vcpu->mutex is held when synchronizing each VMSA, consistent with the existing SEV-ES code path (Red Hat Bugzilla). Patches are available via four commits to the stable kernel tree.

Successful exploitation can result in either corruption of vCPU state or a host kernel crash (denial of service), depending on the timing of the race condition. Because the vulnerability resides in the host kernel's KVM subsystem, a crash affects the entire hypervisor and all guest VMs running on it, making the availability impact significant in virtualized environments. There is no confidentiality or integrity impact identified; the primary risk is availability loss for the host and all hosted guests (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). Exploitation requires local access with low privileges and the ability to manage virtual machines on a host running KVM with SEV-SNP support. The EPSS score is approximately 0.017% (3rd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Upgrade the Linux kernel to a patched version: 6.18.24 or later, 6.19.14 or later, or 7.0.1 or later, depending on the currently deployed kernel branch (GitHub Advisory). Patches are available via the following upstream commits: 30fd9d8c, 4df77742, c87938fc, and cb923ee6 on git.kernel.org. Systems that do not use KVM with SEV-SNP guest support are not affected and do not require immediate action. As a temporary workaround where patching is not immediately feasible, disabling SNP guest launch operations or restricting access to the KVM management interface can reduce exposure.