CVE-2026-31553 KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
Incorrect pointer arithmetic in KVM arm64 allows memory corruption, potentially enabling code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31553?
CVE-2026-31553 is a high-severity memory corruption vulnerability in Linux kernel, published on 24 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
Using "(u64 __user *)hva + offset" to get the virtual addresses of S1/S2 descriptors looks really wrong, if offset is not zero. What we want to get for swapping is hva + offset, not hva + offset*8. ;-)
Fix it.
Which versions are affected by CVE-2026-31553?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31553?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-31553 being exploited?
There is no known exploitation of CVE-2026-31553 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2026-31553, GHSA-6xvj-cpww-rx88, UBUNTU-CVE-2026-31553.