CVE-2026-31628: Linux Kernel Information Disclosure Flaw

CVE-2026-31628 Overview

A vulnerability has been discovered in the Linux kernel affecting x86/CPU handling on AMD Zen1 architecture processors. The Zen1 hardware divider can leave partial results from previous operations under certain circumstances, which can then be leaked by another attacker thread. This side-channel vulnerability enables potential information disclosure between processes sharing the same physical CPU core.

Critical Impact
Local attackers can potentially extract sensitive computation results from other processes running on Zen1 AMD processors through exploitation of the hardware divider's residual data.

Affected Products

Linux Kernel (multiple versions)
Systems running AMD Zen1 architecture processors
Linux Kernel version 4.14 and various other kernel branches

Discovery Timeline

2026-04-24 - CVE-2026-31628 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31628

Vulnerability Analysis

This vulnerability exists within the x86/CPU subsystem of the Linux kernel, specifically affecting AMD Zen1 architecture processors. The hardware divider implementation in Zen1 processors does not properly clear partial computation results after division operations complete. When a division operation is performed, remnants of the calculation can remain accessible in the divider's internal state.

An attacker running code on the same physical CPU core can exploit this behavior through carefully timed operations. By measuring timing differences or directly observing divider state through subsequent division operations, the attacker thread can infer information about computations performed by other threads. This creates a covert channel for information leakage between security domains.

The vulnerability requires local access and the ability to execute code on the affected system. While exploitation requires specific conditions including simultaneous execution on the same CPU core, the attack is feasible in multi-tenant environments where multiple users share physical hardware resources.

Root Cause

The root cause is a hardware design characteristic in AMD Zen1 processors where the floating-point division unit does not completely clear its internal state between operations. This allows partial results from previous division operations to persist and potentially be observable by subsequent operations from different security contexts.

Attack Vector

This vulnerability requires local access to exploit. An attacker must be able to execute arbitrary code on the affected system and schedule execution on the same physical CPU core as the victim process. The attack leverages timing side-channels or direct observation of the divider's residual state to extract information about prior division operations. Multi-threaded environments and systems with hyperthreading enabled are particularly susceptible, as threads sharing a physical core can more easily observe each other's computational side effects.

The Linux kernel patch addresses this by enabling a "chicken bit" — a hardware configuration flag that forces the divider to clear its state between operations, preventing information leakage at the cost of minor performance overhead.

Detection Methods for CVE-2026-31628

Indicators of Compromise

Unusual process scheduling patterns targeting specific CPU cores
Processes performing high-frequency division operations with timing measurements
Side-channel attack toolkits or PoC code designed for Zen1 divider exploitation

Detection Strategies

Monitor for processes with suspicious CPU affinity settings that pin execution to specific cores
Implement behavioral analysis for applications performing unusual patterns of division operations followed by timing measurements
Deploy kernel-level monitoring to detect attempts to exploit CPU microarchitectural side channels

Monitoring Recommendations

Enable CPU performance counter monitoring to detect anomalous division instruction patterns
Implement process isolation policies for sensitive workloads on Zen1 systems
Review system logs for indicators of side-channel attack attempts

How to Mitigate CVE-2026-31628

Immediate Actions Required

Update the Linux kernel to a patched version that includes the FPDSS fix
Apply kernel updates from your Linux distribution's security repository
Consider temporarily disabling simultaneous multithreading (SMT) on critical Zen1 systems until patched

Patch Information

The Linux kernel team has released patches across multiple stable kernel branches to address this vulnerability. The fix enables a hardware "chicken bit" that forces the Zen1 divider to clear partial results between operations. Multiple commit references are available:

Workarounds

Disable SMT/Hyperthreading on Zen1 systems to prevent cross-thread information leakage
Implement strict process isolation using CPU affinity to separate sensitive workloads onto different physical cores
Consider migrating critical workloads to non-Zen1 hardware until patches are applied

bash

# Disable SMT temporarily on a running system (requires root)
echo off > /sys/devices/system/cpu/smt/control

# Verify SMT status
cat /sys/devices/system/cpu/smt/active