CVE-2026-31593: KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU
Reject synchronizing vCPU state to its associated VMSA if the vCPU has already been launched, i.e. if the VMSA has already been encrypted. On a host with SNP enabled, accessing guest-private memory generates an RMP #PF and panics the host.
BUG: unable to handle page fault for address: ff1276cbfdf36000 #PF: supervisor write access in kernel mode #PF: errorcode(0x80000003) - RMP violation PGD 5a31801067 P4D 5a31802067 PUD 40ccfb5063 PMD 40e5954063 PTE 80000040fdf36163 SEV-SNP: PFN 0x40fdf36, RMP entry: [0x6010fffffffff001 - 0x000000000000001f] Oops: Oops: 0003 [#1] SMP NOPTI CPU: 33 UID: 0 PID: 996180 Comm: qemu-system-x86 Tainted: G OE Tainted: [O]=OOTMODULE, [E]=UNSIGNEDMODULE Hardware name: Dell Inc. PowerEdge R7625/0H1TJT, BIOS 1.5.8 07/21/2023 RIP: 0010:sevessyncvmsa+0x54/0x4c0 [kvmamd] Call Trace: <TASK> snplaunchupdatevmsa+0x19d/0x290 [kvmamd] snplaunchfinish+0xb6/0x380 [kvmamd] sevmemencioctl+0x14e/0x720 [kvmamd] kvmarchvmioctl+0x837/0xcf0 [kvm] kvmvmioctl+0x3fd/0xcc0 [kvm] x64sysioctl+0xa3/0x100 x64syscall+0xfe0/0x2350 dosyscall64+0x81/0x10f0 entrySYSCALL64afterhwframe+0x76/0x7e RIP: 0033:0x7ffff673287d </TASK>
Note, the KVM flaw has been present since commit ad73109ae7ec ("KVM: SVM: Provide support to launch and run an SEV-ES guest"), but has only been actively dangerous for the host since SNP support was added. With SEV-ES, KVM would "just" clobber guest state, which is totally fine from a host kernel perspective since userspace can clobber guest state any time before sevlaunchupdatevmsa().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Do not run SEV-ES guests with SEV-SNP enabled on hosts until the Linux kernel has been updated with the fix that rejects attempts to sync VMSA of an already-launched/encrypted vCPU.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31593?
CVE-2026-31593 is classified as a medium severity vulnerability affecting the KVM subsystem in the Linux kernel.
How do I fix CVE-2026-31593?
To address CVE-2026-31593, upgrade your Linux kernel to a version that is not affected by this vulnerability.
What causes CVE-2026-31593?
CVE-2026-31593 is caused by improper handling of attempts to synchronize the Virtual Machine State Area (VMSA) for already launched or encrypted virtual CPUs.
Which Linux kernel versions are affected by CVE-2026-31593?
CVE-2026-31593 affects Linux kernel versions between 6.11 and 6.12.83, 6.13 and 6.18.24, 6.19 and 6.19.14, and 7.0 and 7.0.1.
Is CVE-2026-31593 exploitable in a production environment?
Yes, CVE-2026-31593 may lead to unauthorized access or denial of service in production environments running vulnerable kernel versions.