CVE-2026-31470

A flaw was found in the Linux kernel's TDX guest virtualization component. A malicious host can manipulate the 'quote' buffer length, allowing it to specify a response length larger than the guest's allocated memory. This can lead to information disclosure, where sensitive data beyond the intended buffer can be read by guest userspace and potentially forwarded in attestation requests, which are used to verify the integrity of the virtual machine.

Upstream validates quote_buf->out_len so the host cannot drive reads past the guest allocation into userspace attestation flows. Red Hat emphasizes the trust boundary: impact presumes a misbehaving TDX host. Guest-only mitigations are insufficient; firmware/host stacks must be trusted. Kernel errata carries the guest-side clamp.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.