CyberSecBulletin
CVE-2026-31788NVD status: Modified

Linux: Missing Authorization

Published Updated By the CyberSecBulletin desk

CVE-2026-31788 is a high-severity missing authorization vulnerability in Linux, with a CVSS 3.1 base score of 8.2 out of 10. It can be exploited with local access to the system by an attacker with administrator privileges, without any action from a user. The record lists versions 4eb245ff0d33b618e097a2c23de5df56d4ad6969, 3ee5b9e3de4b8bdd74183d83205481c91a9effc8, 87a803edb2ded911cb587c53bff179d2a2ed2a28 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.2% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 4eb245ff0d33b618e097a2c23de5df56d4ad6969 or 3ee5b9e3de4b8bdd74183d83205481c91a9effc8 or 87a803edb2ded911cb587c53bff179d2a2ed2a28 or 1879319d790f7d57622cdc22807b60ea78b56b6d, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.253 or 5.15.203 or 6.1.167 or 6.6.130, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1c5de1939c204bde9cce87f4eb3d26e9f9eb732b up to, but not including, 4eb245ff0d33b618e097a2c23de5df56d4ad6969; 1c5de1939c204bde9cce87f4eb3d26e9f9eb732b up to, but not including, 3ee5b9e3de4b8bdd74183d83205481c91a9effc8; 1c5de1939c204bde9cce87f4eb3d26e9f9eb732b up to, but not including, 87a803edb2ded911cb587c53bff179d2a2ed2a28; 1c5de1939c204bde9cce87f4eb3d26e9f9eb732b up to, but not including, 1879319d790f7d57622cdc22807b60ea78b56b6d; 1c5de1939c204bde9cce87f4eb3d26e9f9eb732b up to, but not including, 78432d8f0372c71c518096395537fa12be7ff24e; 1c5de1939c204bde9cce87f4eb3d26e9f9eb732b up to, but not including, 389bae9a4409934e8b8d4dbdaaf02a3ae71cf8e4; 1c5de1939c204bde9cce87f4eb3d26e9f9eb732b up to, but not including, cbede2e833da1893afbea9b3ff29b5dda23a4a91; 1c5de1939c204bde9cce87f4eb3d26e9f9eb732b up to, but not including, 453b8fb68f3641fea970db88b7d9a153ed2a37e8; and 1 more ranges4eb245ff0d33b618e097a2c23de5df56d4ad6969, 3ee5b9e3de4b8bdd74183d83205481c91a9effc8, 87a803edb2ded911cb587c53bff179d2a2ed2a28, 1879319d790f7d57622cdc22807b60ea78b56b6d, 78432d8f0372c71c518096395537fa12be7ff24e, 389bae9a4409934e8b8d4dbdaaf02a3ae71cf8e4
LinuxLinux Kernel2.6.37.1 up to, but not including, 5.10.253; 5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.167; 6.2 up to, but not including, 6.6.130; 6.7 up to, but not including, 6.12.78; 6.13 up to, but not including, 6.18.20; 6.19 up to, but not including, 6.19.10; 2.6.37; and 1 more ranges5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
HighAdministrator-level access is required first.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.18.2HighCNA
CVSS 3.18.2HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: restrict usage in unprivileged domU The Xen privcmd driver allows to issue arbitrary hypercalls from user space processes. This is normally no problem, as access is usually limited to root and the hypervisor will deny any hypercalls affecting other domains. In case the guest is booted using secure boot, however, the privcmd driver would be enabling a root user process to modify e.g. kernel memory contents, thus breaking the secure boot feature. The only known case where an unprivileged domU is really needing to use the privcmd driver is the case when it is acting as the device model for another guest. In this case all hypercalls issued via the privcmd driver will target that other guest. Fortunately the privcmd driver can already be locked down to allow only hypercalls targeting a specific domain, but this mode can be activated from user land only today. The target domain can be obtained from Xenstore, so when not running in dom0 restrict the privcmd driver to that target domain from the beginning, resolving the potential problem of breaking secure boot. This is XSA-482 --- V2: - defer reading from Xenstore if Xenstore isn't ready yet (Jan Beulich) - wait in open() if target domain isn't known yet - issue message in case no target domain found (Jan Beulich)

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

How developers prevent this class of flaw

  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
  • Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework and the OWASP ESAPI Access Control feature.

More Missing Authorization vulnerabilities (CWE-862)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Missing Authorization vulnerabilities

Spotted an error? Tell us.