CVE-2026-31561

Vulnerability

Analysis

CVE-2026-31561 addresses a race condition in the Linux kernel's handling of the FRED (Flexible Return and Event Delivery) feature on x86 CPUs. The issue occurs because the CR4 pinned bits mask included the FRED bit, ensuring it remained set when other code modified CR4. During boot, FRED is initialized first on the BSP (bootstrap processor) and later on APs (application processors), creating a window where exceptions cannot be handled properly. In SEV-{ES,SNP} or TDX guest environments, triggering an exception during this window causes a triple fault, as FRED MSRs have not yet been set up [1][2].

Exploitation and

Attack Surface

A previous attempt to mitigate this by temporarily disabling CR4 pinning while an AP is not online introduced a different security issue: an attacker could modify a single bit in RW memory (the online bit) to disable CR4 pinning and subsequently disable SMEP/SMAP protections, enabling more severe attacks [3]. The fix removes the FRED bit from the CR4 pinning mask entirely, eliminating the need to temporarily disable pinning. If an attacker manages to clear FRED in CR4, the idt_invalidate() function ensures the system crashes on the first subsequent exception, which is a safer outcome than allowing privilege escalation [2][3].

Impact

Successful exploitation could lead to system instability (triple faults) in confidential computing environments (SEV, TDX), causing denial of service. The original fix's security downgrade (CR4 pinning disable) could also enable bypass of SMEP/SMAP, but the current patch prevents that vector. The CVSS score of 5.5 (Medium) reflects the local access required and primarily availability impact, though the complexity is low [1][2].

Mitigation

This vulnerability is fixed in Linux kernel commits d7853d9fe94a, 00d956dafa76, 411df123c017, and a6e14114684d (all leading to the same resolution) [1][2][3][4]. Users should update to kernels containing these patches. There is no workaround; the fix is part of ongoing mainline and stable kernel releases.