CVE-2026-31591

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) component. This vulnerability allows a local user in userspace to manipulate or run a virtual CPU (vCPU) while its state is being synchronized during the Secure Nested Paging (SNP) launch process. This improper synchronization can lead to corruption of the vCPU state or, in the worst case, cause the host kernel to crash, resulting in a Denial of Service (DoS).

SEV-SNP launch finish must synchronize all vCPU VMSAs; upstream now takes the required locks so a racing vCPU cannot observe half-updated state. Red Hat treats this as a confidential-computing correctness fix on AMD hosts with SNP enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.