{
  "threat_severity" : "Moderate",
  "public_date" : "2026-04-24T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU",
    "id" : "2461536",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2461536"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-821",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nKVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU\nReject synchronizing vCPU state to its associated VMSA if the vCPU has\nalready been launched, i.e. if the VMSA has already been encrypted.  On a\nhost with SNP enabled, accessing guest-private memory generates an RMP #PF\nand panics the host.\nBUG: unable to handle page fault for address: ff1276cbfdf36000\n#PF: supervisor write access in kernel mode\n#PF: error_code(0x80000003) - RMP violation\nPGD 5a31801067 P4D 5a31802067 PUD 40ccfb5063 PMD 40e5954063 PTE 80000040fdf36163\nSEV-SNP: PFN 0x40fdf36, RMP entry: [0x6010fffffffff001 - 0x000000000000001f]\nOops: Oops: 0003 [#1] SMP NOPTI\nCPU: 33 UID: 0 PID: 996180 Comm: qemu-system-x86 Tainted: G           OE\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nHardware name: Dell Inc. PowerEdge R7625/0H1TJT, BIOS 1.5.8 07/21/2023\nRIP: 0010:sev_es_sync_vmsa+0x54/0x4c0 [kvm_amd]\nCall Trace:\n<TASK>\nsnp_launch_update_vmsa+0x19d/0x290 [kvm_amd]\nsnp_launch_finish+0xb6/0x380 [kvm_amd]\nsev_mem_enc_ioctl+0x14e/0x720 [kvm_amd]\nkvm_arch_vm_ioctl+0x837/0xcf0 [kvm]\nkvm_vm_ioctl+0x3fd/0xcc0 [kvm]\n__x64_sys_ioctl+0xa3/0x100\nx64_sys_call+0xfe0/0x2350\ndo_syscall_64+0x81/0x10f0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7ffff673287d\n</TASK>\nNote, the KVM flaw has been present since commit ad73109ae7ec (\"KVM: SVM:\nProvide support to launch and run an SEV-ES guest\"), but has only been\nactively dangerous for the host since SNP support was added.  With SEV-ES,\nKVM would \"just\" clobber guest state, which is totally fine from a host\nkernel perspective since userspace can clobber guest state any time before\nsev_launch_update_vmsa().", "A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) virtualization module. When Secure Nested Paging (SNP) is enabled, an attempt to update the state of an already running and encrypted virtual machine can cause the host system to crash. This vulnerability leads to a Denial of Service (DoS) for the host, making the system unavailable." ],
  "statement" : "Upstream rejects illegal attempts to sync VMSA for vCPUs already launched under SNP, preventing inconsistent encrypted state. Red Hat concurs with AMD KVM hardening guidance: apply kernel updates on SNP systems.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-31593\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31593\nhttps://lore.kernel.org/linux-cve-announce/2026042415-CVE-2026-31593-455f@gregkh/T" ],
  "name" : "CVE-2026-31593",
  "csaw" : false
}