Xen Privcmd Driver Vulnerability in Linux Kernel by Xen Project

CVE-2026-31788

What is CVE-2026-31788?

The Xen privcmd driver in the Linux kernel previously allowed unprivileged domain user processes to execute arbitrary hypercalls. While normally restricted to root and hypervisor layers, this vulnerability posed a risk when a guest was booted with secure boot enabled, potentially allowing modification of kernel memory and breaking the secure boot integrity. This issue was addressed by enhancing the privcmd driver's access controls, ensuring that hypercalls are restricted to specific target domains, thereby maintaining security in environments leveraging secure boot.

References