CVE-2026-31593
MediumSummary
A vulnerability was found in the Linux kernel's KVM for AMD SEV. It fails to reject attempts to synchronize vCPU state with an already encrypted VMSA after the VM has been launched.
Risk Assessment
A privileged guest attacker could potentially manipulate vCPU state post-launch, leading to confidentiality or integrity breaches in SEV-protected environments.
Recommendation
Immediately update the Linux kernel to a patched version (commit in stable branch). Prior to update, restrict access to SEV virtual machine management.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU Reject synchronizing vCPU state to its associated VMSA if the vCPU has already been launched, i.e. if the VMSA has already been encrypted. On a host wit