Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-04-24T00:00:00 kernel: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-820

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish Lock all vCPUs when synchronizing and encrypting VMSAs for SNP guests, as allowing userspace to manipulate and/or run a vCPU while its state is being synchronized would at best corrupt vCPU state, and at worst crash the host kernel. Opportunistically assert that vcpu->mutex is held when synchronizing its VMSA (the SEV-ES path already locks vCPUs).

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) component. This vulnerability allows a local user in userspace to manipulate or run a virtual CPU (vCPU) while its state is being synchronized during the Secure Nested Paging (SNP) launch process. This improper synchronization can lead to corruption of the vCPU state or, in the worst case, cause the host kernel to crash, resulting in a Denial of Service (DoS).

SEV-SNP launch finish must synchronize all vCPU VMSAs; upstream now takes the required locks so a racing vCPU cannot observe half-updated state. Red Hat treats this as a confidential-computing correctness fix on AMD hosts with SNP enabled. Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Fix deferred kernel Red Hat Enterprise Linux 7 Fix deferred kernel-rt Red Hat Enterprise Linux 8 Fix deferred kernel Red Hat Enterprise Linux 8 Fix deferred kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-31591 https://nvd.nist.gov/vuln/detail/CVE-2026-31591 https://lore.kernel.org/linux-cve-announce/2026042415-CVE-2026-31591-4148@gregkh/T