[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <e07ab218-c15c-4844-9594-dd456860f83d@citrix.com>
Date: Tue, 24 Mar 2026 12:17:34 +0000
From: Andrew Cooper <andrew.cooper3@...rix.com>
To: Greg KH <greg@...ah.com>, oss-security@...ts.openwall.com
Cc: Andrew Cooper <andrew.cooper3@...rix.com>, xen-announce@...ts.xen.org,
xen-devel@...ts.xen.org, xen-users@...ts.xen.org,
"Xen.org security team" <security-team-members@....org>
Subject: Re: Xen Security Advisory 482 v2 - Linux privcmd
driver can circumvent kernel lockdown
On 24/03/2026 12:16 pm, Greg KH wrote:
> On Tue, Mar 24, 2026 at 12:05:44PM +0000, Xen.org security team wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA256
>>
>> Xen Security Advisory XSA-482
>> version 2
>>
>> Linux privcmd driver can circumvent kernel lockdown
>>
>> UPDATES IN VERSION 2
>> ====================
>>
>> Public release.
>>
>> ISSUE DESCRIPTION
>> =================
>>
>> The Linux kernel's privcmd driver can be abused to circumvent kernel
>> lockdown (secure boot), e.g. by modifying page tables to enable user
>> mode to modify kernel memory.
>>
>> The CNA covering Linux has refused to assign a CVE at this juncture.
> This is now assigned to CVE-2026-31788
Thankyou. I'll send out an update.
~Andrew
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
