In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc() Using "(u64 __user *)hva + offset" t…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · git.kernel.org
• Repository · git.kernel.org

Timeline

Detection, updates, and resolution for this record.

1. Apr 24, 2026 · NIST NVD

   Detected

   In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc() Using "(u64 __user *)hva + offset" to get the virtual addresses of S1/S2 descriptors looks really wrong, if offset is not zero. What we want to get for swapping is hva + offset, not hva + offset*8. ;-) Fix it.

2. Jun 17, 2026 · NIST NVD

   Updated

   In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc() Using "(u64 __user *)hva + offset" to get the virtual addresses of S1/S2 descriptors looks really wrong, if offset is not zero. What we want to get for swapping is hva + offset, not hva + offset*8. ;-) Fix it.

Affected

• cpe linux/linux kernelversion unspecified
• cpe linux/linux kernel6.19
• cpe linux/linux kernel7.0

Sources

• CVE.orgVulnerability recordCVE-2026-31553

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-31553

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc() Using "(u64 __user *)hva + offset" to get the virtual addresses of S1/S2 descriptors looks really wrong, if offset is not zero. What we want to get

  nvd.nist.gov

References

• Patch · git.kernel.org
• Patch · git.kernel.org