CVE-2026-31553
published 2026-04-24CVE-2026-31553: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc() Using "(u64 __user *)hva +…
PriorityP340high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.12%
2.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
Using "(u64 __user *)hva + offset" to get the virtual addresses of S1/S2
descriptors looks really wrong, if offset is not zero. What we want to get
for swapping is hva + offset, not hva + offset*8. ;-)
Fix it.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= f6927b41d57390c597a126063e2e518911976878 < 4307e05e568782fc92eff651b09ee5dee88a058d | 4307e05e568782fc92eff651b09ee5dee88a058d |
| linux | linux | >= f6927b41d57390c597a126063e2e518911976878 < 0496acc42fb51eee040b5170cec05cec41385540 | 0496acc42fb51eee040b5170cec05cec41385540 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.19.1 < 6.19.11 | 6.19.11 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6xvj-cpww-rx88: In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
Using "(u64 __use
ghsa_unreviewed·2026-04-24
CVE-2026-31553 GHSA-6xvj-cpww-rx88: In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
Using "(u64 __use
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
Using "(u64 __user *)hva + offset" to get the virtual addresses of S1/S2
descriptors looks really wrong, if offset is not zero. What we want to get
for swapping is hva + offset, not hva + offset*8. ;-)
Fix it.
Red Hat
kernel: KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
vendor_redhat·2026-04-24
CVE-2026-31553 CWE-468 kernel: KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
kernel: KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) component. Specifically, in the ARM64 architecture, an incorrect calculation of the descriptor address in the `__kvm_at_swap_desc()` function could lead to memory corruption. This vulnerability may allow an attacker to cause system instability or affect the integrity of virtual machines.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not a
No detection rules found.
No public exploits indexed.
2026-04-24
Published