PT-2026-34375 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-05-07 · CVE-2026-31470

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the tdx-guest component where the host-controlled value quote buf->out len is not properly validated. This value determines the number of bytes of the quote copied to guest userspace. In TDX environments using remote attestation, this lack of validation allows the host to specify a response length exceeding the guest's allocation or modify the response during consumption. This can lead to the leakage of data beyond the pages allocated for quote buf (up to TSM REPORT OUTBLOB MAX) to guest userspace, potentially crossing container protection boundaries in deployments using per-container configs-tsm-report interfaces.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-31470

Affected Products

Linux Kernel

References · 15

• https://ubuntu.com/security/CVE-2026-31470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31470 · Security Note
• https://git.kernel.org/stable/c/a079a62883e3365de592cea9f7a669d8115433b0 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31470 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31470 · Vendor Advisory
• https://git.kernel.org/stable/c/02ca2d9d197723696cb9cc0cb159eb7e8bf5f89b · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31470 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31470 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31470 · Security Note
• https://git.kernel.org/stable/c/6f3c8795ae9ba74fa10fe979293d1904712d3fb1 · Patch
• https://git.kernel.org/stable/c/c3fd16c3b98ed726294feab2f94f876290bf7b61 · Patch
• https://twitter.com/CVEnew/status/2046980015456227448 · Twitter Post
• https://t.me/cveNotify/162596 · Telegram Post
• https://git.kernel.org/linus/c3fd16c3b98ed726294feab2f94f876290bf7b61 · Note
• https://docs.bell-sw.com/security/cves/CVE-2026-31470 · Note