CVE-2026-31561

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31561", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.116Z", "datePublished": "2026-04-24T14:35:43.302Z", "dateUpdated": "2026-05-11T22:11:09.941Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:11:09.941Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask\n\nCommit in Fixes added the FRED CR4 bit to the CR4 pinned bits mask so\nthat whenever something else modifies CR4, that bit remains set. Which\nin itself is a perfectly fine idea.\n\nHowever, there's an issue when during boot FRED is initialized: first on\nthe BSP and later on the APs. Thus, there's a window in time when\nexceptions cannot be handled.\n\nThis becomes particularly nasty when running as SEV-{ES,SNP} or TDX\nguests which, when they manage to trigger exceptions during that short\nwindow described above, triple fault due to FRED MSRs not being set up\nyet.\n\nSee Link tag below for a much more detailed explanation of the\nsituation.\n\nSo, as a result, the commit in that Link URL tried to address this\nshortcoming by temporarily disabling CR4 pinning when an AP is not\nonline yet.\n\nHowever, that is a problem in itself because in this case, an attack on\nthe kernel needs to only modify the online bit - a single bit in RW\nmemory - and then disable CR4 pinning and then disable SM*P, leading to\nmore and worse things to happen to the system.\n\nSo, instead, remove the FRED bit from the CR4 pinning mask, thus\nobviating the need to temporarily disable CR4 pinning.\n\nIf someone manages to disable FRED when poking at CR4, then\nidt_invalidate() would make sure the system would crash'n'burn on the\nfirst exception triggered, which is a much better outcome security-wise."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kernel/cpu/common.c"], "versions": [{"version": "ff45746fbf005f96e42bea466698e3fdbf926013", "lessThan": "d7853d9fe94abf43b46c57b0b7f8418198b7615a", "status": "affected", "versionType": "git"}, {"version": "ff45746fbf005f96e42bea466698e3fdbf926013", "lessThan": "a6e14114684d2324e5401617d6d01acb4a4e0e22", "status": "affected", "versionType": "git"}, {"version": "ff45746fbf005f96e42bea466698e3fdbf926013", "lessThan": "00d956dafa76f86a73424fe5cce3d604a8be2e4b", "status": "affected", "versionType": "git"}, {"version": "ff45746fbf005f96e42bea466698e3fdbf926013", "lessThan": "411df123c017169922cc767affce76282b8e6c85", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kernel/cpu/common.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d7853d9fe94abf43b46c57b0b7f8418198b7615a"}, {"url": "https://git.kernel.org/stable/c/a6e14114684d2324e5401617d6d01acb4a4e0e22"}, {"url": "https://git.kernel.org/stable/c/00d956dafa76f86a73424fe5cce3d604a8be2e4b"}, {"url": "https://git.kernel.org/stable/c/411df123c017169922cc767affce76282b8e6c85"}], "title": "x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/kernel/cpu/common.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d7853d9fe94abf43b46c57b0b7f8418198b7615a", "status": "affected", "version": "ff45746fbf005f96e42bea466698e3fdbf926013", "versionType": "git"}, {"lessThan": "a6e14114684d2324e5401617d6d01acb4a4e0e22", "status": "affected", "version": "ff45746fbf005f96e42bea466698e3fdbf926013", "versionType": "git"}, {"lessThan": "00d956dafa76f86a73424fe5cce3d604a8be2e4b", "status": "affected", "version": "ff45746fbf005f96e42bea466698e3fdbf926013", "versionType": "git"}, {"lessThan": "411df123c017169922cc767affce76282b8e6c85", "status": "affected", "version": "ff45746fbf005f96e42bea466698e3fdbf926013", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/kernel/cpu/common.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.80", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC9469D5-3400-4C2C-A51B-AF83A8E8F623", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.9.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED39847A-3B46-4729-B7CA-B2C30B9FA8FE", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*", "matchCriteriaId": "3F2A4A3D-068A-4CF2-A09F-9C7937DDB0A5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask\n\nCommit in Fixes added the FRED CR4 bit to the CR4 pinned bits mask so\nthat whenever something else modifies CR4, that bit remains set. Which\nin itself is a perfectly fine idea.\n\nHowever, there's an issue when during boot FRED is initialized: first on\nthe BSP and later on the APs. Thus, there's a window in time when\nexceptions cannot be handled.\n\nThis becomes particularly nasty when running as SEV-{ES,SNP} or TDX\nguests which, when they manage to trigger exceptions during that short\nwindow described above, triple fault due to FRED MSRs not being set up\nyet.\n\nSee Link tag below for a much more detailed explanation of the\nsituation.\n\nSo, as a result, the commit in that Link URL tried to address this\nshortcoming by temporarily disabling CR4 pinning when an AP is not\nonline yet.\n\nHowever, that is a problem in itself because in this case, an attack on\nthe kernel needs to only modify the online bit - a single bit in RW\nmemory - and then disable CR4 pinning and then disable SM*P, leading to\nmore and worse things to happen to the system.\n\nSo, instead, remove the FRED bit from the CR4 pinning mask, thus\nobviating the need to temporarily disable CR4 pinning.\n\nIf someone manages to disable FRED when poking at CR4, then\nidt_invalidate() would make sure the system would crash'n'burn on the\nfirst exception triggered, which is a much better outcome security-wise."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nx86/cpu: Eliminar X86_CR4_FRED de la m\u00e1scara de bits fijados de CR4\n\nEl commit en Fixes a\u00f1adi\u00f3 el bit FRED CR4 a la m\u00e1scara de bits fijados de CR4 para que cada vez que algo m\u00e1s modifique CR4, ese bit permanezca establecido. Lo cual en s\u00ed mismo es una idea perfectamente v\u00e1lida.\n\nSin embargo, hay un problema cuando durante el arranque FRED es inicializado: primero en el BSP y luego en los APs. As\u00ed, hay una ventana de tiempo cuando las excepciones no pueden ser manejadas.\n\nEsto se vuelve particularmente desagradable cuando se ejecuta como invitados SEV-{ES,SNP} o TDX los cuales, cuando logran disparar excepciones durante esa corta ventana descrita anteriormente, causan una triple falla debido a que los MSR de FRED a\u00fan no est\u00e1n configurados.\n\nVer la etiqueta Link a continuaci\u00f3n para una explicaci\u00f3n mucho m\u00e1s detallada de la situaci\u00f3n.\n\nAs\u00ed, como resultado, el commit en esa URL de Link intent\u00f3 abordar esta deficiencia deshabilitando temporalmente el fijado de CR4 cuando un AP a\u00fan no est\u00e1 en l\u00ednea.\n\nSin embargo, eso es un problema en s\u00ed mismo porque en este caso, un ataque al kernel solo necesita modificar el bit en l\u00ednea - un solo bit en memoria RW - y luego deshabilitar el fijado de CR4 y luego deshabilitar SMP, lo que lleva a que ocurran cosas m\u00e1s y peores en el sistema.\n\nAs\u00ed que, en su lugar, eliminar el bit FRED de la m\u00e1scara de fijado de CR4, obviando as\u00ed la necesidad de deshabilitar temporalmente el fijado de CR4.\n\nSi alguien logra deshabilitar FRED al manipular CR4, entonces idt_invalidate() se asegurar\u00eda de que el sistema se bloqueara y fallara con la primera excepci\u00f3n disparada, lo cual es un resultado mucho mejor en t\u00e9rminos de seguridad."}], "id": "CVE-2026-31561", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-24T15:16:30.500", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/00d956dafa76f86a73424fe5cce3d604a8be2e4b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/411df123c017169922cc767affce76282b8e6c85"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a6e14114684d2324e5401617d6d01acb4a4e0e22"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d7853d9fe94abf43b46c57b0b7f8418198b7615a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask", "id": "2461500", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461500"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-15", "details": ["A flaw was found in the Linux kernel's handling of the CR4 pinned bits mask for FRED (Flexible Return and Event Delivery). An attacker could exploit this by modifying a specific bit in memory to disable CR4 pinning, potentially leading to a system crash. This vulnerability could result in a Denial of Service (DoS) for affected systems."], "name": "CVE-2026-31561", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31561\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31561\nhttps://lore.kernel.org/linux-cve-announce/2026042458-CVE-2026-31561-ca96@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff45746fbf005f96e42bea466698e3fdbf926013,d7853d9fe94abf43b46c57b0b7f8418198b7615a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff45746fbf005f96e42bea466698e3fdbf926013,a6e14114684d2324e5401617d6d01acb4a4e0e22)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff45746fbf005f96e42bea466698e3fdbf926013,00d956dafa76f86a73424fe5cce3d604a8be2e4b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff45746fbf005f96e42bea466698e3fdbf926013,411df123c017169922cc767affce76282b8e6c85)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.80,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T20:18:43.860562+00:00", "value": {"mitigation_remediation": ["Update the kernel to a version that contains the commit fixing the CR4 pinning logic \u2013 the patch is included in kernel 6.9 and all 7.0 release candidates.", "Reboot after the kernel upgrade to ensure the CR4 registers and FRED MSRs are initialized before any guests are launched.", "If an immediate kernel upgrade is not possible, avoid running SEV\u2011ES/SNP or TDX guests until the host can be patched, or otherwise restrict guest exception handling during boot to close the vulnerable window."], "summary": {"action": "Patch Immediately", "impact": "Kernel Crash / System Unavailability"}, "threat_synthesis": {"affected_systems": "All Linux kernel versions that include the broken CR4 pinning logic \u2013 specifically the 6.9 series and all 7.0 release candidates up to rc7 \u2013 are affected. The issue exists on the default Linux distribution kernels; no user\u2011space applications are directly impacted.", "description_and_impact": "The flaw originates from the removal of the X86_CR4_FRED bit from the CR4 pinned bits mask in the Linux kernel\u2019s x86 CPU code. This change creates a brief period during boot where the FRED MSR is not yet initialized, meaning that if an exception occurs in that window \u2013 for example when a SEV\u2011ES/SNP or TDX guest triggers an exception \u2013 the host will experience a triple fault and crash. The impact is a kernel panic that results in a loss of service but does not provide a direct escalation of privileges to an attacker.", "risk_and_exploitability": "With a CVSS score of 5.5 the vulnerability is considered of moderate severity. The EPSS score of <\u202f1\u202f% indicates a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires privileged kernel access or the ability to run a guest that can trigger an exception during the narrow initialization window, making it less likely to be abused in the real world."}}}}, "created": "2026-04-27T19:00:15.817784+00:00", "updated": "2026-04-28T20:30:06.175877+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}