endpoint-software-vulnerabilityprivilege-escalation-methodwidely-deployed-product-advisory

Xen Advisory Warns Linux `privcmd` Flaw Can Bypass Kernel Lockdown

Vulnerability Disclosure · 7 sources · Updated 4mo ago · First seen Mar 24, 2026

Xen disclosed XSA-482 for CVE-2026-31788, a flaw in the Linux kernel's privcmd driver that can let an administrator inside an unprivileged Xen guest bypass kernel lockdown protections enforced under secure boot. The bug can be abused to perform actions on the guest kernel that should be blocked in secure mode, including modifying page tables in a way that could allow user mode to alter kernel memory.

The issue affects Xen PV, PVH, and HVM guests running Linux with secure boot enabled. Xen said BSD-based systems are believed unaffected because they do not support secure boot in this context. The vulnerability was discovered by Teddy Astie of Vates, no mitigation is currently known, and remediation requires applying the published Linux patch set; the latest advisory revision notes that the flaw has now been assigned CVE-2026-31788.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Mar 24, 2026

Mar 24, 20268mo ago
XSA-482 version 3 adds CVE-2026-31788 assignment
A later revision of Xen Security Advisory 482 noted that the vulnerability had been assigned CVE-2026-31788. The update did not change the core impact, which includes possible page-table modification that could enable user-mode modification of kernel memory inside affected Linux guests.
Mar 24, 20268mo ago
Xen publishes XSA-482 for Linux privcmd kernel lockdown bypass
Xen disclosed Security Advisory XSA-482 for a flaw in the Linux kernel's privcmd driver that can let an administrator in an unprivileged Xen guest bypass secure-boot kernel lockdown protections. The advisory said affected systems include Xen PV, PVH, and HVM guests running Linux with secure boot, with no known mitigation other than applying the provided Linux patches.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Kernel lockdown bypass in Linux Xen privcmd (CVE-2026-31788)

Affected products

2 linked

Linux KernelXen

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

7 references tracked. Mallory keeps watching after this page renders.

Oss Security Mailing ListNews · Mar 24, 2026

oss-sec: Xen Security Advisory 482 v2 - Linux privcmd driver can circumvent kernel lockdownOpen source ↗

Oss Security Mailing ListNews · Mar 24, 2026

oss-sec: Xen Security Advisory 482 v3 (CVE-2026-31788) - Linux privcmd driver can circumvent kernel lockdownOpen source ↗

Oss Security Mailing ListNews · Mar 24, 2026

oss-sec: Re: Xen Security Advisory 482 v2 - Linux privcmd driver can circumvent kernel lockdownOpen source ↗

Oss Security Mailing ListNews · Mar 24, 2026

oss-sec: Re: Xen Security Advisory 482 v2 - Linux privcmd driver can circumvent kernel lockdownOpen source ↗

Oss Security Mailing ListNews · Mar 24, 2026

oss-sec: Re: Xen Security Advisory 482 v2 - Linux privcmd driver can circumvent kernel lockdownOpen source ↗

Oss Security Mailing ListNews · Mar 24, 2026

oss-sec: Re: Xen Security Advisory 482 v2 - Linux privcmd driver can circumvent kernel lockdownOpen source ↗

BlueteamsecNews · May 8, 2023

oss-sec: Xen Security Advisory 482 v2 - Linux privcmd driver can circumvent kernel lockdown - Infosec.PubOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Xen Advisory Warns Linux `privcmd` Flaw Can Bypass Kernel Lockdown

How this story unfolded

XSA-482 version 3 adds CVE-2026-31788 assignment

Xen publishes XSA-482 for Linux privcmd kernel lockdown bypass

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Xen Advisories Disclose Linux Guest Kernel Flaws Enabling Privilege Escalation

Xen warns AMD Zen 2 opcode cache flaw can enable guest-to-host escalation

Ubuntu Warns Januscape KVM Flaw Could Let Guests Compromise Hypervisor Hosts

Xen Advisory Warns Linux `privcmd` Flaw Can Bypass Kernel Lockdown

How this story unfolded

XSA-482 version 3 adds CVE-2026-31788 assignment

Xen publishes XSA-482 for Linux privcmd kernel lockdown bypass

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Xen Advisories Disclose Linux Guest Kernel Flaws Enabling Privilege Escalation

Xen warns AMD Zen 2 opcode cache flaw can enable guest-to-host escalation

Ubuntu Warns Januscape KVM Flaw Could Let Guests Compromise Hypervisor Hosts