CVE-2026-31568: Linux Kernel Privilege Escalation Flaw

CVE-2026-31568 Overview

CVE-2026-31568 is a Linux kernel vulnerability in the s390 memory management subsystem. The flaw affects how the kernel handles secure storage access exceptions for pages donated to the Ultravisor on IBM Z (s390) platforms. When such exceptions occur on pages without the PG_arch_1 bit set, the kernel enters an unrecoverable exception loop. The issue is tracked under [CWE-125] and impacts confidentiality and availability on affected systems running protected virtualization workloads.

Critical Impact
A local, low-privileged context on s390 hardware can trigger a non-recoverable secure storage access exception loop, denying service to protected virtualization workloads that rely on memory donated to the Ultravisor.

Affected Products

Linux kernel branches containing the s390 Ultravisor donated memory handling code
Linux kernel 5.7 and subsequent stable releases prior to the fix
Linux kernel 7.0 release candidates rc1 through rc7

Discovery Timeline

2026-04-24 - CVE-2026-31568 published to the National Vulnerability Database
2026-04-27 - Last updated in the NVD database

Technical Details for CVE-2026-31568

Vulnerability Analysis

The vulnerability resides in the s390 memory management code path that handles secure storage access exceptions. On IBM Z systems running Protected Virtual Machines (PVMs), the Ultravisor enforces isolation between the host kernel and guest secure memory. The host kernel relies on the PG_arch_1 page flag to determine whether a page must be exported before access. The flag is set for non-exported guest secure memory but is absent on storage donated to the Ultravisor, because donated pages cannot be exported by the kernel.

When a secure storage access exception is raised on a donated page in kernel context, the existing handler calls arch_make_folio_accessible(). That function inspects the PG_arch_1 flag and returns immediately when the flag is clear, treating the page as already accessible. No exception fixup occurs, so the faulting instruction is retried and triggers the same exception again. This produces an infinite secure storage access exception loop that cannot be resolved without external intervention.

Root Cause

The root cause is an incorrect assumption that the absence of PG_arch_1 implies the page is accessible. For donated memory, the flag is absent because export is prohibited, not because the page has already been exported. The exception handler therefore lacks a fixup path for this state.

Attack Vector

Exploitation requires local access with low privileges on an affected s390 host configured for Protected Virtualization. A workload interacting with memory donated to the Ultravisor can trigger the faulting condition. The result is a denial of service against the kernel context handling that exception. Code execution and information disclosure are not indicated by the available data; the CWE-125 classification reflects the out-of-bounds read class associated with the faulting memory access pattern.

No public proof-of-concept or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-31568

Indicators of Compromise

Repeated secure storage access exception messages in dmesg or the kernel ring buffer originating from s390 memory management code
Kernel soft lockup or RCU stall warnings on CPUs handling Ultravisor donated memory
Unresponsive Protected Virtual Machine workloads on IBM Z hosts coinciding with kernel exception logs

Detection Strategies

Inventory kernel versions across s390 fleet and compare against the fixed commits 43ac2d18db11, b00be77302d7, and b36b0e804aee
Monitor kernel logs for patterns indicating recurring secure storage access exceptions on the same page or address range
Correlate host kernel exception activity with guest PVM availability metrics to identify exception-loop conditions

Monitoring Recommendations

Forward s390 host kernel logs to a centralized logging or SIEM pipeline for pattern analysis
Alert on sustained kernel CPU utilization combined with exception handler activity on Ultravisor-enabled hosts
Track package versions on IBM Z Linux hosts to confirm patched kernels are deployed across the environment

How to Mitigate CVE-2026-31568

Immediate Actions Required

Apply the upstream stable kernel update containing the fix on all IBM Z systems running Protected Virtualization workloads
Identify hosts using Ultravisor donated memory and prioritize them for patching
Restrict local access on affected hosts until patches are deployed to reduce the population able to trigger the condition

Patch Information

The fix modifies the s390 secure storage access exception handler to unconditionally attempt export and to invoke the exception fixup path when export fails, breaking the loop for donated pages. The upstream commits are available in the kernel.org stable tree:

Distribution vendors backport stable tree fixes to supported kernels. Consult vendor advisories for the corresponding package versions.

Workarounds

No upstream workaround is documented; patching is the recommended remediation
Where patching is delayed, avoid configurations that donate memory to the Ultravisor on affected kernels
Limit which local users and services can execute workloads on Protected Virtualization hosts to reduce trigger paths

bash

# Verify the running kernel version on an s390 host
uname -r

# Confirm the fix is present after applying a vendor update
rpm -q kernel        # RHEL / SUSE based systems
dpkg -l linux-image-$(uname -r)  # Debian / Ubuntu based systems