CVE-2026-31561

{"id": "CVE-2026-31561", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ff45746fbf005f96e42bea466698e3fdbf926013", "lessThan": "d7853d9fe94abf43b46c57b0b7f8418198b7615a", "versionType": "git"}, {"status": "affected", "version": "ff45746fbf005f96e42bea466698e3fdbf926013", "lessThan": "a6e14114684d2324e5401617d6d01acb4a4e0e22", "versionType": "git"}, {"status": "affected", "version": "ff45746fbf005f96e42bea466698e3fdbf926013", "lessThan": "00d956dafa76f86a73424fe5cce3d604a8be2e4b", "versionType": "git"}, {"status": "affected", "version": "ff45746fbf005f96e42bea466698e3fdbf926013", "lessThan": "411df123c017169922cc767affce76282b8e6c85", "versionType": "git"}], "programFiles": ["arch/x86/kernel/cpu/common.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.80", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/x86/kernel/cpu/common.c"], "defaultStatus": "affected"}]}], "published": "2026-04-24T15:16:30.500", "references": [{"url": "https://git.kernel.org/stable/c/00d956dafa76f86a73424fe5cce3d604a8be2e4b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/411df123c017169922cc767affce76282b8e6c85", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a6e14114684d2324e5401617d6d01acb4a4e0e22", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d7853d9fe94abf43b46c57b0b7f8418198b7615a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask\n\nCommit in Fixes added the FRED CR4 bit to the CR4 pinned bits mask so\nthat whenever something else modifies CR4, that bit remains set. Which\nin itself is a perfectly fine idea.\n\nHowever, there's an issue when during boot FRED is initialized: first on\nthe BSP and later on the APs. Thus, there's a window in time when\nexceptions cannot be handled.\n\nThis becomes particularly nasty when running as SEV-{ES,SNP} or TDX\nguests which, when they manage to trigger exceptions during that short\nwindow described above, triple fault due to FRED MSRs not being set up\nyet.\n\nSee Link tag below for a much more detailed explanation of the\nsituation.\n\nSo, as a result, the commit in that Link URL tried to address this\nshortcoming by temporarily disabling CR4 pinning when an AP is not\nonline yet.\n\nHowever, that is a problem in itself because in this case, an attack on\nthe kernel needs to only modify the online bit - a single bit in RW\nmemory - and then disable CR4 pinning and then disable SM*P, leading to\nmore and worse things to happen to the system.\n\nSo, instead, remove the FRED bit from the CR4 pinning mask, thus\nobviating the need to temporarily disable CR4 pinning.\n\nIf someone manages to disable FRED when poking at CR4, then\nidt_invalidate() would make sure the system would crash'n'burn on the\nfirst exception triggered, which is a much better outcome security-wise."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nx86/cpu: Eliminar X86_CR4_FRED de la m\u00e1scara de bits fijados de CR4\n\nEl commit en Fixes a\u00f1adi\u00f3 el bit FRED CR4 a la m\u00e1scara de bits fijados de CR4 para que cada vez que algo m\u00e1s modifique CR4, ese bit permanezca establecido. Lo cual en s\u00ed mismo es una idea perfectamente v\u00e1lida.\n\nSin embargo, hay un problema cuando durante el arranque FRED es inicializado: primero en el BSP y luego en los APs. As\u00ed, hay una ventana de tiempo cuando las excepciones no pueden ser manejadas.\n\nEsto se vuelve particularmente desagradable cuando se ejecuta como invitados SEV-{ES,SNP} o TDX los cuales, cuando logran disparar excepciones durante esa corta ventana descrita anteriormente, causan una triple falla debido a que los MSR de FRED a\u00fan no est\u00e1n configurados.\n\nVer la etiqueta Link a continuaci\u00f3n para una explicaci\u00f3n mucho m\u00e1s detallada de la situaci\u00f3n.\n\nAs\u00ed, como resultado, el commit en esa URL de Link intent\u00f3 abordar esta deficiencia deshabilitando temporalmente el fijado de CR4 cuando un AP a\u00fan no est\u00e1 en l\u00ednea.\n\nSin embargo, eso es un problema en s\u00ed mismo porque en este caso, un ataque al kernel solo necesita modificar el bit en l\u00ednea - un solo bit en memoria RW - y luego deshabilitar el fijado de CR4 y luego deshabilitar SMP, lo que lleva a que ocurran cosas m\u00e1s y peores en el sistema.\n\nAs\u00ed que, en su lugar, eliminar el bit FRED de la m\u00e1scara de fijado de CR4, obviando as\u00ed la necesidad de deshabilitar temporalmente el fijado de CR4.\n\nSi alguien logra deshabilitar FRED al manipular CR4, entonces idt_invalidate() se asegurar\u00eda de que el sistema se bloqueara y fallara con la primera excepci\u00f3n disparada, lo cual es un resultado mucho mejor en t\u00e9rminos de seguridad."}], "lastModified": "2026-11-11T23:10:00.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC9469D5-3400-4C2C-A51B-AF83A8E8F623", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.9.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED39847A-3B46-4729-B7CA-B2C30B9FA8FE", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F2A4A3D-068A-4CF2-A09F-9C7937DDB0A5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}