CVE-2026-31553: Linux Kernel

High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc() Using "(u64 __user *)hva + offset" to get the virtual addresses of S1/S2 descriptors looks really wrong, if offset is not zero. What we want to get for swapping is hva + offset, not hva + offset*8. ;-) Fix it.

Affected products

• Linux Linux Kernel: from 6.19.1, before 6.19.11 (fixed in 6.19.11); version 6.19 only; version 7.0 only

Published 2026-04-24. Last modified 2026-06-17.