---
id: CVE-2026-31591
title: 'KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish

  Lock all vCPUs when synchronizing and encrypting VMSAs for SNP guests, as
  allowing userspace to …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ad27ce155566f2b4400fa865859834592bd18777 <
    30fd9d8c82087742168db779929d8be0459b0716
  - >-
    Linux >= ad27ce155566f2b4400fa865859834592bd18777 <
    4df77742e8b9a6b935bdf46f02fd0aca4d4ee7f5
  - >-
    Linux >= ad27ce155566f2b4400fa865859834592bd18777 <
    c87938fc7d99a06a7e5477c45b4e5a4148f85d66
  - >-
    Linux >= ad27ce155566f2b4400fa865859834592bd18777 <
    cb923ee6a80f4e604e6242a4702b59251e61a380
  - Linux 6.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:22:18.787773Z'
published: '2026-04-24'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:18.969Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31591'
references:
  - url: 'https://git.kernel.org/stable/c/30fd9d8c82087742168db779929d8be0459b0716'
  - url: 'https://git.kernel.org/stable/c/4df77742e8b9a6b935bdf46f02fd0aca4d4ee7f5'
  - url: 'https://git.kernel.org/stable/c/c87938fc7d99a06a7e5477c45b4e5a4148f85d66'
  - url: 'https://git.kernel.org/stable/c/cb923ee6a80f4e604e6242a4702b59251e61a380'
tags:
  - cve.org
epss: 0.00122
epssPercentile: 0.01982
ingestedAt: '2026-11-06T15:54:04.057Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish

Lock all vCPUs when synchronizing and encrypting VMSAs for SNP guests, as
allowing userspace to manipulate and/or run a vCPU while its state is being
synchronized would at best corrupt vCPU state, and at worst crash the host
kernel.

Opportunistically assert that vcpu->mutex is held when synchronizing its
VMSA (the SEV-ES path already locks vCPUs).

## Affected

- `Linux >= ad27ce155566f2b4400fa865859834592bd18777 < 30fd9d8c82087742168db779929d8be0459b0716`
- `Linux >= ad27ce155566f2b4400fa865859834592bd18777 < 4df77742e8b9a6b935bdf46f02fd0aca4d4ee7f5`
- `Linux >= ad27ce155566f2b4400fa865859834592bd18777 < c87938fc7d99a06a7e5477c45b4e5a4148f85d66`
- `Linux >= ad27ce155566f2b4400fa865859834592bd18777 < cb923ee6a80f4e604e6242a4702b59251e61a380`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.