{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-31470", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.097Z", "datePublished": "2026-04-22T13:53:58.925Z", "dateUpdated": "2026-08-05T12:22:49.625Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:49.625Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: tdx-guest: Fix handling of host controlled 'quote' buffer length\n\nValidate host controlled value `quote_buf->out_len` that determines how\nmany bytes of the quote are copied out to guest userspace. In TDX\nenvironments with remote attestation, quotes are not considered private,\nand can be forwarded to an attestation server.\n\nCatch scenarios where the host specifies a response length larger than\nthe guest's allocation, or otherwise races modifying the response while\nthe guest consumes it.\n\nThis prevents contents beyond the pages allocated for `quote_buf`\n(up to TSM_REPORT_OUTBLOB_MAX) from being read out to guest userspace,\nand possibly forwarded in attestation requests.\n\nRecall that some deployments want per-container configs-tsm-report\ninterfaces, so the leak may cross container protection boundaries, not\njust local root." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is reached by local access to the configfs TSM report interface, specifically writing `inblob` and reading `outblob`; it is not directly packet- or network-facing.\nAC:L - Once a quote request is triggered, the host/VMM controls `quote_buf->out_len` and can set or race the shared quote buffer deterministically. The race noted by the fix is attacker-controlled from the host side.\nPR:L - Default configfs setup is root-oriented, but the ABI explicitly supports per-container report instances via bind mounts, making delegated low-privilege local access a reasonable deployment. Per the overestimate rule, this is scored as low privileges rather than high.\nUI:N - An attacker with access to the report instance can trigger report generation and readback directly. No separate victim action is required.\nS:U - The impact is disclosure or crash within the guest kernel/userspace security authority. There is no guest-to-host escape, IOMMU bypass, or other cross-authority control transfer.\nC:H - The host-controlled length can cause the kernel to copy data beyond the allocated TDX quote buffer, up to the TSM outblob cap, into guest userspace or forwarded attestation data. This is an out-of-bounds kernel memory read not bounded to a few bytes.\nI:N - The bug is an over-read/copy-out of kernel memory based on a malicious length. The investigated path does not provide an out-of-bounds write or direct data modification primitive.\nA:H - Malicious or raced lengths can force oversized allocations and out-of-bounds kernel reads that may fault or oops, and the trigger can be repeated through report generation. Under the higher-severity rule, this is scored as high availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/virt/coco/tdx-guest/tdx-guest.c" ], "versions": [ { "version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "lessThan": "a079a62883e3365de592cea9f7a669d8115433b0", "status": "affected", "versionType": "git" }, { "version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "lessThan": "6f3c8795ae9ba74fa10fe979293d1904712d3fb1", "status": "affected", "versionType": "git" }, { "version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "lessThan": "02ca2d9d197723696cb9cc0cb159eb7e8bf5f89b", "status": "affected", "versionType": "git" }, { "version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63", "lessThan": "c3fd16c3b98ed726294feab2f94f876290bf7b61", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/virt/coco/tdx-guest/tdx-guest.c" ], "versions": [ { "version": "6.7", "status": "affected" }, { "version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.80" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.18.21" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.19.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/a079a62883e3365de592cea9f7a669d8115433b0" }, { "url": "https://git.kernel.org/stable/c/6f3c8795ae9ba74fa10fe979293d1904712d3fb1" }, { "url": "https://git.kernel.org/stable/c/02ca2d9d197723696cb9cc0cb159eb7e8bf5f89b" }, { "url": "https://git.kernel.org/stable/c/c3fd16c3b98ed726294feab2f94f876290bf7b61" } ], "title": "virt: tdx-guest: Fix handling of host controlled 'quote' buffer length", "x_generator": { "engine": "bippy-1.2.0" } } } }