CVE-2026-31553: Linux Kernel Privilege Escalation Flaw

CVE-2026-31553 Overview

CVE-2026-31553 is a Linux kernel vulnerability in the KVM (Kernel-based Virtual Machine) subsystem for arm64. The flaw resides in __kvm_at_swap_desc(), which computes incorrect virtual addresses for Stage 1 and Stage 2 (S1/S2) translation table descriptors. The expression (u64 __user *)hva + offset performs pointer arithmetic that scales offset by eight bytes, yielding hva + offset*8 instead of hva + offset. The mistake corrupts descriptor handling during address translation swaps inside guest virtual machines. Attackers with local guest-level access can trigger memory operations against unintended addresses on the host hypervisor.

Critical Impact
A local, low-privileged actor inside a KVM guest can compromise confidentiality, integrity, and availability of the host arm64 hypervisor through incorrect S1/S2 descriptor pointer arithmetic.

Affected Products

Linux kernel 6.19
Linux kernel 7.0 release candidates rc1 through rc7
arm64 systems running KVM with affected kernel builds

Discovery Timeline

2026-04-24 - CVE-2026-31553 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31553

Vulnerability Analysis

The defect lives in the arm64 KVM helper __kvm_at_swap_desc(), used during Address Translation (AT) instruction emulation. The function swaps descriptor values in guest page tables mapped into the host virtual address space (hva). It must access the descriptor at byte offset offset inside that mapping.

The original code casts hva to u64 __user * before adding offset. In C, pointer arithmetic scales the addend by the pointee size. Adding offset to a u64 * therefore advances the pointer by offset * 8 bytes. When offset is non-zero, the kernel reads and writes the wrong descriptor location. The corrected logic operates on the byte address hva + offset directly.

The scope is Changed because the vulnerable hypervisor code straddles the guest/host boundary. A guest user can influence offset through normal AT instruction paths and cause the host to manipulate memory outside the intended descriptor.

Root Cause

The root cause is incorrect typed-pointer arithmetic on a user virtual address [CWE-682, computation error]. Treating an opaque byte offset as an index into an array of u64 elements multiplies the displacement by the element size, breaking the invariant that the access target equals hva + offset bytes.

Attack Vector

Exploitation requires local access from within a KVM guest on a vulnerable arm64 host. The guest issues operations that route through __kvm_at_swap_desc() with a non-zero offset. The host then reads or writes attacker-influenced descriptor memory at the wrong address, enabling tampering with hypervisor state, leaking host data, or destabilizing the host kernel. No user interaction on the host is required.

No public proof-of-concept or in-the-wild exploitation is recorded for CVE-2026-31553.

Detection Methods for CVE-2026-31553

Indicators of Compromise

Unexpected kernel oops, BUG, or page fault entries in dmesg referencing __kvm_at_swap_desc or KVM arm64 translation paths.
KVM guests on arm64 producing repeated AT instruction emulation traces immediately before host instability.
Host memory corruption symptoms (e.g., unexplained guest crashes, hypervisor stalls) on arm64 servers running affected kernel versions.

Detection Strategies

Inventory all arm64 hosts and confirm running kernel version against the affected range (6.19 and 7.0 release candidates).
Correlate hypervisor crash signatures with guest workloads invoking AT-class instructions to surface abuse patterns.
Compare loaded kernel build hashes against the upstream fix commits 0496acc42fb5 and 4307e05e5687.

Monitoring Recommendations

Forward kernel ring buffer logs and KVM trace events to a centralized logging platform for retention and search.
Alert on KVM module faults, hypervisor panics, and unexpected guest VM resets on arm64 hosts.
Monitor process and workload telemetry from Linux hosts to identify abnormal local activity preceding hypervisor errors.

How to Mitigate CVE-2026-31553

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org commit 0496acc42fb5 and kernel.org commit 4307e05e5687.
Prioritize arm64 hypervisor hosts that run multi-tenant or untrusted guest workloads.
Restrict local and guest-level access on affected hosts until patching completes.

Patch Information

The fix replaces the typed pointer arithmetic so the descriptor address resolves to hva + offset in bytes. Distribution kernels rebased on the patched stable trees include the correction. Operators of custom kernel builds must cherry-pick both referenced commits and rebuild affected arm64 kernels.

Workarounds

Avoid running untrusted guests on arm64 KVM hosts that cannot be patched immediately.
Where feasible, migrate sensitive workloads to hosts running kernel versions outside the affected range.
Enforce strict isolation policies and least privilege for guest administrators until the patched kernel is deployed.

bash

# Verify running kernel and confirm patch presence on Linux arm64 hosts
uname -r
uname -m
# After updating, confirm the fix commits are included in the kernel source build
git -C /usr/src/linux log --oneline | grep -E '0496acc42fb5|4307e05e5687'