CVE-2026-31470

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31470", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.097Z", "datePublished": "2026-04-22T13:53:58.925Z", "dateUpdated": "2026-10-19T18:35:50.013Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:49.625Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: tdx-guest: Fix handling of host controlled 'quote' buffer length\n\nValidate host controlled value `quote_buf->out_len` that determines how\nmany bytes of the quote are copied out to guest userspace. In TDX\nenvironments with remote attestation, quotes are not considered private,\nand can be forwarded to an attestation server.\n\nCatch scenarios where the host specifies a response length larger than\nthe guest's allocation, or otherwise races modifying the response while\nthe guest consumes it.\n\nThis prevents contents beyond the pages allocated for `quote_buf`\n(up to TSM_REPORT_OUTBLOB_MAX) from being read out to guest userspace,\nand possibly forwarded in attestation requests.\n\nRecall that some deployments want per-container configs-tsm-report\ninterfaces, so the leak may cross container protection boundaries, not\njust local root."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached by local access to the configfs TSM report interface, specifically writing `inblob` and reading `outblob`; it is not directly packet- or network-facing.\nAC:L - Once a quote request is triggered, the host/VMM controls `quote_buf->out_len` and can set or race the shared quote buffer deterministically. The race noted by the fix is attacker-controlled from the host side.\nPR:L - Default configfs setup is root-oriented, but the ABI explicitly supports per-container report instances via bind mounts, making delegated low-privilege local access a reasonable deployment. Per the overestimate rule, this is scored as low privileges rather than high.\nUI:N - An attacker with access to the report instance can trigger report generation and readback directly. No separate victim action is required.\nS:U - The impact is disclosure or crash within the guest kernel/userspace security authority. There is no guest-to-host escape, IOMMU bypass, or other cross-authority control transfer.\nC:H - The host-controlled length can cause the kernel to copy data beyond the allocated TDX quote buffer, up to the TSM outblob cap, into guest userspace or forwarded attestation data. This is an out-of-bounds kernel memory read not bounded to a few bytes.\nI:N - The bug is an over-read/copy-out of kernel memory based on a malicious length. The investigated path does not provide an out-of-bounds write or direct data modification primitive.\nA:H - Malicious or raced lengths can force oversized allocations and out-of-bounds kernel reads that may fault or oops, and the trigger can be repeated through report generation. Under the higher-severity rule, this is scored as high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/virt/coco/tdx-guest/tdx-guest.c"], "versions": [{"version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "lessThan": "a079a62883e3365de592cea9f7a669d8115433b0", "status": "affected", "versionType": "git"}, {"version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "lessThan": "6f3c8795ae9ba74fa10fe979293d1904712d3fb1", "status": "affected", "versionType": "git"}, {"version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "lessThan": "02ca2d9d197723696cb9cc0cb159eb7e8bf5f89b", "status": "affected", "versionType": "git"}, {"version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "lessThan": "c3fd16c3b98ed726294feab2f94f876290bf7b61", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/virt/coco/tdx-guest/tdx-guest.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a079a62883e3365de592cea9f7a669d8115433b0"}, {"url": "https://git.kernel.org/stable/c/6f3c8795ae9ba74fa10fe979293d1904712d3fb1"}, {"url": "https://git.kernel.org/stable/c/02ca2d9d197723696cb9cc0cb159eb7e8bf5f89b"}, {"url": "https://git.kernel.org/stable/c/c3fd16c3b98ed726294feab2f94f876290bf7b61"}], "title": "virt: tdx-guest: Fix handling of host controlled 'quote' buffer length", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31470", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:09:50.983675Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:35:50.013Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31470", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.097Z", "datePublished": "2026-04-22T13:53:58.925Z", "dateUpdated": "2026-10-16T15:20:12.218Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:49.625Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: tdx-guest: Fix handling of host controlled 'quote' buffer length\n\nValidate host controlled value `quote_buf->out_len` that determines how\nmany bytes of the quote are copied out to guest userspace. In TDX\nenvironments with remote attestation, quotes are not considered private,\nand can be forwarded to an attestation server.\n\nCatch scenarios where the host specifies a response length larger than\nthe guest's allocation, or otherwise races modifying the response while\nthe guest consumes it.\n\nThis prevents contents beyond the pages allocated for `quote_buf`\n(up to TSM_REPORT_OUTBLOB_MAX) from being read out to guest userspace,\nand possibly forwarded in attestation requests.\n\nRecall that some deployments want per-container configs-tsm-report\ninterfaces, so the leak may cross container protection boundaries, not\njust local root."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached by local access to the configfs TSM report interface, specifically writing `inblob` and reading `outblob`; it is not directly packet- or network-facing.\nAC:L - Once a quote request is triggered, the host/VMM controls `quote_buf->out_len` and can set or race the shared quote buffer deterministically. The race noted by the fix is attacker-controlled from the host side.\nPR:L - Default configfs setup is root-oriented, but the ABI explicitly supports per-container report instances via bind mounts, making delegated low-privilege local access a reasonable deployment. Per the overestimate rule, this is scored as low privileges rather than high.\nUI:N - An attacker with access to the report instance can trigger report generation and readback directly. No separate victim action is required.\nS:U - The impact is disclosure or crash within the guest kernel/userspace security authority. There is no guest-to-host escape, IOMMU bypass, or other cross-authority control transfer.\nC:H - The host-controlled length can cause the kernel to copy data beyond the allocated TDX quote buffer, up to the TSM outblob cap, into guest userspace or forwarded attestation data. This is an out-of-bounds kernel memory read not bounded to a few bytes.\nI:N - The bug is an over-read/copy-out of kernel memory based on a malicious length. The investigated path does not provide an out-of-bounds write or direct data modification primitive.\nA:H - Malicious or raced lengths can force oversized allocations and out-of-bounds kernel reads that may fault or oops, and the trigger can be repeated through report generation. Under the higher-severity rule, this is scored as high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/virt/coco/tdx-guest/tdx-guest.c"], "versions": [{"version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "lessThan": "a079a62883e3365de592cea9f7a669d8115433b0", "status": "affected", "versionType": "git"}, {"version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "lessThan": "6f3c8795ae9ba74fa10fe979293d1904712d3fb1", "status": "affected", "versionType": "git"}, {"version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "lessThan": "02ca2d9d197723696cb9cc0cb159eb7e8bf5f89b", "status": "affected", "versionType": "git"}, {"version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "lessThan": "c3fd16c3b98ed726294feab2f94f876290bf7b61", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/virt/coco/tdx-guest/tdx-guest.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a079a62883e3365de592cea9f7a669d8115433b0"}, {"url": "https://git.kernel.org/stable/c/6f3c8795ae9ba74fa10fe979293d1904712d3fb1"}, {"url": "https://git.kernel.org/stable/c/02ca2d9d197723696cb9cc0cb159eb7e8bf5f89b"}, {"url": "https://git.kernel.org/stable/c/c3fd16c3b98ed726294feab2f94f876290bf7b61"}], "title": "virt: tdx-guest: Fix handling of host controlled 'quote' buffer length", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31470", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:09:50.983675Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:09:51.569Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/virt/coco/tdx-guest/tdx-guest.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a079a62883e3365de592cea9f7a669d8115433b0", "status": "affected", "version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "versionType": "git"}, {"lessThan": "6f3c8795ae9ba74fa10fe979293d1904712d3fb1", "status": "affected", "version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "versionType": "git"}, {"lessThan": "02ca2d9d197723696cb9cc0cb159eb7e8bf5f89b", "status": "affected", "version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "versionType": "git"}, {"lessThan": "c3fd16c3b98ed726294feab2f94f876290bf7b61", "status": "affected", "version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/virt/coco/tdx-guest/tdx-guest.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.80", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED39847A-3B46-4729-B7CA-B2C30B9FA8FE", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: tdx-guest: Fix handling of host controlled 'quote' buffer length\n\nValidate host controlled value `quote_buf->out_len` that determines how\nmany bytes of the quote are copied out to guest userspace. In TDX\nenvironments with remote attestation, quotes are not considered private,\nand can be forwarded to an attestation server.\n\nCatch scenarios where the host specifies a response length larger than\nthe guest's allocation, or otherwise races modifying the response while\nthe guest consumes it.\n\nThis prevents contents beyond the pages allocated for `quote_buf`\n(up to TSM_REPORT_OUTBLOB_MAX) from being read out to guest userspace,\nand possibly forwarded in attestation requests.\n\nRecall that some deployments want per-container configs-tsm-report\ninterfaces, so the leak may cross container protection boundaries, not\njust local root."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvirt: tdx-guest: Correcci\u00f3n del manejo de la longitud del b\u00fafer de \u2019quote\u2019 controlado por el host\n\nValidar el valor controlado por el host \u2019quote_buf -> out_len\u2019 que determina cu\u00e1ntos bytes de la \u2019quote\u2019 se copian al espacio de usuario del invitado. En entornos TDX con atestaci\u00f3n remota, las \u2019quotes\u2019 no se consideran privadas y pueden ser reenviadas a un servidor de atestaci\u00f3n.\n\nCapturar escenarios donde el host especifica una longitud de respuesta mayor que la asignaci\u00f3n del invitado, o de otro modo compite modificando la respuesta mientras el invitado la consume.\n\nEsto evita que el contenido m\u00e1s all\u00e1 de las p\u00e1ginas asignadas para \u2019quote_buf\u2019 (hasta TSM_REPORT_OUTBLOB_MAX) sea le\u00eddo al espacio de usuario del invitado y posiblemente reenviado en solicitudes de atestaci\u00f3n.\n\nRecordar que algunas implementaciones quieren interfaces configs-tsm-report por contenedor, por lo que la fuga puede cruzar los l\u00edmites de protecci\u00f3n del contenedor, no solo la ra\u00edz local."}], "id": "CVE-2026-31470", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31470", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:09:50.983675Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:43.473", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/02ca2d9d197723696cb9cc0cb159eb7e8bf5f89b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6f3c8795ae9ba74fa10fe979293d1904712d3fb1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a079a62883e3365de592cea9f7a669d8115433b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c3fd16c3b98ed726294feab2f94f876290bf7b61"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length", "id": "2460674", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460674"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's TDX guest virtualization component. A malicious host can manipulate the 'quote' buffer length, allowing it to specify a response length larger than the guest's allocated memory. This can lead to information disclosure, where sensitive data beyond the intended buffer can be read by guest userspace and potentially forwarded in attestation requests, which are used to verify the integrity of the virtual machine."], "name": "CVE-2026-31470", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31470\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31470\nhttps://lore.kernel.org/linux-cve-announce/2026042254-CVE-2026-31470-350c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f4738f56d1dc62aaba69b33702a5ab098f1b8c63,a079a62883e3365de592cea9f7a669d8115433b0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f4738f56d1dc62aaba69b33702a5ab098f1b8c63,6f3c8795ae9ba74fa10fe979293d1904712d3fb1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f4738f56d1dc62aaba69b33702a5ab098f1b8c63,02ca2d9d197723696cb9cc0cb159eb7e8bf5f89b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f4738f56d1dc62aaba69b33702a5ab098f1b8c63,c3fd16c3b98ed726294feab2f94f876290bf7b61)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.80,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-04-22T19:00:08.097916+00:00", "updated": "2026-05-07T20:00:12.046545+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}