CVE-2026-31470

Vulnerability

Description

CVE-2026-31470 is a flaw in the Linux kernel's TDX (Trusted Domain Extensions) guest driver for remote attestation. The vulnerability lies in the handling of the quote_buf->out_len field provided by the host. The driver failed to validate that the host-controlled output length does not exceed the actual buffer allocation allocated by the guest. This allows a malicious host to specify a larger length, causing the kernel to copy out-of-bounds memory into the userspace buffer for the quote [1][2][3][4].

Exploitation

Conditions

The attack surface is limited to TDX guest environments where remote attestation is used. The attacker must be in control of the host, which is a privileged position in cloud or virtualized deployments. No authentication is required from the guest side; the host supplies the crafted length value during the attestation quote generation process. The faulty code path is triggered when the guest reads the quote result from the TDX module and passes it to userspace without validating the host-provided size [3][4].

Impact

If exploited, an attacker controlling the host can read kernel memory from the guest, specifically the contents beyond the allocated quote_buf pages (up to TSM_REPORT_OUTBLOB_MAX). This leaked memory could include sensitive data such as encryption keys, secrets, or other guest kernel data. In deployments with per-container configfs-tsm-report interfaces, the leak may cross container boundaries, exposing data from different containers to userspace, potentially compromising isolation between containers [2][4].

Mitigation

The fix has been included in the Linux kernel stable tree. The patches [1][2][3][4] add proper validation of quote_buf->out_len against the actual allocation size before copying the quote to userspace. System administrators should apply the updated kernel version and reboot. No workarounds are available; the vulnerability is resolved by updating to a patched kernel.