CVE-2026-31591: Linux Kernel Privilege Escalation Bug

CVE-2026-31591 Overview

CVE-2026-31591 is a local denial-of-service vulnerability in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem. The flaw resides in the AMD Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) code path that synchronizes and encrypts Virtual Machine Save Areas (VMSAs) during guest launch finish. The kernel failed to lock all virtual CPUs (vCPUs) while their state was being synchronized. A local user with permission to manage KVM guests can manipulate or run a vCPU concurrently with the synchronization routine, corrupting vCPU state or crashing the host kernel.

Critical Impact
A local privileged user managing SEV-SNP guests can crash the host kernel by racing vCPU operations against VMSA synchronization.

Affected Products

Linux Kernel (mainline branches containing KVM SEV-SNP support)
Distributions shipping the affected KVM/SEV code paths
Hosts running AMD EPYC processors with SEV-SNP enabled

Discovery Timeline

2026-04-24 - CVE-2026-31591 published to the National Vulnerability Database
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31591

Vulnerability Analysis

The vulnerability is a race condition in the KVM SEV-SNP launch finish flow. During SNP_LAUNCH_FINISH, the kernel iterates over each vCPU to synchronize its register state and encrypt the corresponding VMSA before measurement is finalized. Without holding vcpu->mutex on every vCPU, userspace retains the ability to issue KVM_RUN or state-modifying ioctls on other vCPUs in parallel. The synchronization routine reads and writes vCPU state that another thread may simultaneously mutate or execute, producing inconsistent VMSA contents and use-after-free-style memory accesses inside the host kernel.

Root Cause

The SEV-ES launch path already locked individual vCPUs through vcpu->mutex before touching their state. The SEV-SNP synchronization path inherited the same logical requirement but omitted the lock acquisition for the full vCPU set. The kernel patch resolves the issue by locking all vCPUs in the VM for the duration of the synchronize-and-encrypt sequence and adding a lockdep assertion confirming vcpu->mutex is held when synchronizing VMSAs.

Attack Vector

Exploitation requires local access and the ability to interact with /dev/kvm to create and control an SEV-SNP guest. An attacker scripts two threads: one issues KVM_SEV_SNP_LAUNCH_FINISH against the VM while the second concurrently calls KVM_RUN or state ioctls on sibling vCPUs. The unsynchronized access corrupts VMSA contents in the best case and dereferences inconsistent kernel structures in the worst case, leading to a host kernel panic. The CWE category is recorded as NVD-CWE-noinfo, and EPSS estimates exploitation likelihood at 0.013%.

No public proof-of-concept code is available. The vulnerability mechanism and fix are documented in the upstream patches referenced below.

Detection Methods for CVE-2026-31591

Indicators of Compromise

Unexpected host kernel oops or panic messages referencing sev.c, snp_launch_finish, or sev_es_sync_vmsa in dmesg or /var/log/kern.log.
Host crashes correlating with tenant-initiated SEV-SNP guest launches.
Repeated KVM_SEV_SNP_LAUNCH_FINISH ioctl invocations from non-administrative processes.

Detection Strategies

Audit kernel version strings on AMD EPYC hosts and flag systems missing commits 30fd9d8, 4df7774, c87938f, or cb923ee.
Monitor auditd for ioctl syscalls against /dev/kvm issued by non-virtualization service accounts.
Correlate guest launch events with host kernel stability metrics to detect crash patterns aligned with SNP launches.

Monitoring Recommendations

Forward kernel ring buffer messages and crash dumps to a centralized logging platform for review.
Track the set of users and processes permitted to open /dev/kvm and alert on unexpected additions.
Baseline host uptime on SEV-SNP-enabled hypervisors and investigate unplanned reboots.

How to Mitigate CVE-2026-31591

Immediate Actions Required

Apply the upstream Linux kernel patches to all hosts running KVM with SEV-SNP enabled.
Restrict /dev/kvm access to trusted virtualization service accounts using group ownership and ACLs.
If patching is not immediately possible, disable SEV-SNP guest creation on affected hosts until a fixed kernel is deployed.

Patch Information

The fix is committed to the upstream Linux kernel and stable trees. Refer to the patches at Kernel Patch 30fd9d8, Kernel Patch 4df7774, Kernel Patch c87938f, and Kernel Patch cb923ee. The patches lock all vCPUs for the duration of VMSA synchronization and add a lockdep assertion enforcing vcpu->mutex ownership.

Workarounds

Limit the set of local users with permission to create or manage KVM guests on AMD SEV-SNP hosts.
Disable the SEV-SNP feature in BIOS or via kernel module parameters where confidential computing is not required.
Schedule SNP guest launches through a single privileged orchestrator to remove concurrent userspace control of vCPUs.

bash

# Verify kernel version and SEV-SNP status
uname -r
cat /sys/module/kvm_amd/parameters/sev_snp

# Restrict /dev/kvm access to the kvm group only
sudo chown root:kvm /dev/kvm
sudo chmod 0660 /dev/kvm

# Optional: disable SEV-SNP until patched kernel is deployed
sudo modprobe -r kvm_amd
sudo modprobe kvm_amd sev_snp=0