CVE-2026-31588
published 2026-04-24CVE-2026-31588: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use scratch field in MMIO fragment to hold small write values When exiting to…
PriorityP346high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.13%
2.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Use scratch field in MMIO fragment to hold small write values
When exiting to userspace to service an emulated MMIO write, copy the
to-be-written value to a scratch field in the MMIO fragment if the size
of the data payload is 8 bytes or less, i.e. can fit in a single chunk,
instead of pointing the fragment directly at the source value.
This fixes a class of use-after-free bugs that occur when the emulator
initiates a write using an on-stack, local variable as the source, the
write splits a page boundary, *and* both pages are MMIO pages. Because
KVM's ABI only allows for physically contiguous MMIO requests, accesses
that split MMIO pages are separated into two fragments, and are sent to
userspace one at a time. When KVM attempts to complete userspace MMIO in
response to KVM_RUN after the first fragment, KVM will detect the second
fragment and generate a second userspace exit, and reference the on-stack
variable.
The issue is most visible if the second KVM_RUN is performed by a separate
task, in which case the stack of the initiating task can show up as truly
freed data.
BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420
Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984
CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace:
dump_stack+0xbe/0xfd
print_address_description.constprop.0+0x19/0x170
__kasan_report.cold+0x6c/0x84
kasan_report+0x3a/0x50
check_memory_region+0xfd/0x1f0
memcpy+0x20/0x60
complete_emulated_mmio+0x305/0x420
kvm_arch_vcpu_ioctl_run+0x63f/0x6d0
kvm_vcpu_ioctl+0x413/0xb20
__se_sys_ioctl+0x111/0x160
do_syscall_64+0x30/0x40
entry_SYSCALL_64_after_hwframe+0x67/0xd1
RIP: 0033:0x42477d
Code: 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faa8e68
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= f78146b0f9230765c6315b2e14f56112513389ad < 019d0bd32b9a4646ba35d904907452039e2db700 | 019d0bd32b9a4646ba35d904907452039e2db700 |
| linux | linux | >= f78146b0f9230765c6315b2e14f56112513389ad < 4569c66dd9e94a22cd0796b6514a8b25ffff16a1 | 4569c66dd9e94a22cd0796b6514a8b25ffff16a1 |
| linux | linux | >= f78146b0f9230765c6315b2e14f56112513389ad < 52570e73d48f1c73836d37e594667117b4c2a5a8 | 52570e73d48f1c73836d37e594667117b4c2a5a8 |
| linux | linux | >= f78146b0f9230765c6315b2e14f56112513389ad < dc6a6c3db3a4eca7e747cfc46e22c08d016c68f7 | dc6a6c3db3a4eca7e747cfc46e22c08d016c68f7 |
| linux | linux | >= f78146b0f9230765c6315b2e14f56112513389ad < b5a02d37eb0739f462fa12df449ab9b3480c783b | b5a02d37eb0739f462fa12df449ab9b3480c783b |
| linux | linux | >= f78146b0f9230765c6315b2e14f56112513389ad < 22d2ff69d487a32a8b88f9c970120fc2daa08a77 | 22d2ff69d487a32a8b88f9c970120fc2daa08a77 |
| linux | linux | >= f78146b0f9230765c6315b2e14f56112513389ad < 2b83d91e9ae92fe1258d7040a32430bbb3bb7d6e | 2b83d91e9ae92fe1258d7040a32430bbb3bb7d6e |
| linux | linux | >= f78146b0f9230765c6315b2e14f56112513389ad < 3a7b6d75c8f85b09dea893f64a85a356bcf6c3fe | 3a7b6d75c8f85b09dea893f64a85a356bcf6c3fe |
| linux | linux | >= f78146b0f9230765c6315b2e14f56112513389ad < 0b16e69d17d8c35c5c9d5918bf596c75a44655d3 | 0b16e69d17d8c35c5c9d5918bf596c75a44655d3 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 3.5 < 6.6.136 | 6.6.136 |
| linux | linux_kernel | >= 6.13 < 6.18.24 | 6.18.24 |
| linux | linux_kernel | >= 6.19 < 6.19.14 | 6.19.14 |
| linux | linux_kernel | >= 6.7 < 6.12.83 | 6.12.83 |
| linux | linux_kernel | >= 7.0 < 7.0.1 | 7.0.1 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-ibm | — | — |
| ubuntu | linux-nvidia | — | — |
| ubuntu | linux-oracle | — | — |
| ubuntu | linux-raspi | — | — |
| ubuntu | linux-realtime | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
vendor_ubuntu2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-07-06·CVSS 2.0
CVE-2026-46009 [LOW] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus drive
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-07-02·CVSS 2.0
CVE-2026-46316 [LOW] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-01·CVSS 2.0
CVE-2026-46042 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus drivers;
- HID
Red Hat
kernel: KVM: x86: Use scratch field in MMIO fragment to hold small write values
vendor_redhat·2026-04-24·CVSS 7.0
CVE-2026-31588 [MEDIUM] CWE-825 kernel: KVM: x86: Use scratch field in MMIO fragment to hold small write values
kernel: KVM: x86: Use scratch field in MMIO fragment to hold small write values
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) component. This vulnerability, a use-after-free, occurs when KVM processes Memory-mapped I/O (MMIO) writes that span across different memory pages, and an internal temporary variable is used. A malicious guest operating system or a local user could exploit this by performing specific MMIO write operations, leading to KVM attempting to access memory that has already been released. This can result in memory corruption, which might allow for information disclosure or the execution of unauthorized code.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: ker
GHSA
GHSA-g8q5-fwjh-4q25: In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Use scratch field in MMIO fragment to hold small write values
When exi
ghsa_unreviewed·2026-04-24
CVE-2026-31588 GHSA-g8q5-fwjh-4q25: In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Use scratch field in MMIO fragment to hold small write values
When exi
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Use scratch field in MMIO fragment to hold small write values
When exiting to userspace to service an emulated MMIO write, copy the
to-be-written value to a scratch field in the MMIO fragment if the size
of the data payload is 8 bytes or less, i.e. can fit in a single chunk,
instead of pointing the fragment directly at the source value.
This fixes a class of use-after-free bugs that occur when the emulator
initiates a write using an on-stack, local variable as the source, the
write splits a page boundary, *and* both pages are MMIO pages. Because
KVM's ABI only allows for physically contiguous MMIO requests, accesses
that split MMIO pages are separated into two fragments, and are sent to
userspace one at a time
VulDB
Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0 MMIO Page use after free
vuldb·2026-04-24
CVE-2026-31588 [CRITICAL] Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0 MMIO Page use after free
A vulnerability marked as critical has been reported in Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0. The affected element is an unknown function of the component MMIO Page. Performing a manipulation results in use after free.
This vulnerability is known as CVE-2026-31588. Access to the local network is required for this attack. No exploit is available.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/019d0bd32b9a4646ba35d904907452039e2db700https://git.kernel.org/stable/c/0b16e69d17d8c35c5c9d5918bf596c75a44655d3https://git.kernel.org/stable/c/22d2ff69d487a32a8b88f9c970120fc2daa08a77https://git.kernel.org/stable/c/2b83d91e9ae92fe1258d7040a32430bbb3bb7d6ehttps://git.kernel.org/stable/c/3a7b6d75c8f85b09dea893f64a85a356bcf6c3fehttps://git.kernel.org/stable/c/4569c66dd9e94a22cd0796b6514a8b25ffff16a1https://git.kernel.org/stable/c/52570e73d48f1c73836d37e594667117b4c2a5a8https://git.kernel.org/stable/c/b5a02d37eb0739f462fa12df449ab9b3480c783bhttps://git.kernel.org/stable/c/dc6a6c3db3a4eca7e747cfc46e22c08d016c68f7
2026-04-24
Published