Skip to main content
CVE-2025-31936VulnerabilityPublished 09/16/2026Updated 10/25/2026

Red Hat Security Advisory: microcode_ctl security, bug fix, and enhancement update

Affects Red Hat Product Security Red HatSource GCVE Database

0

Mentioned vulnerabilities

Authoritative record:CVE-2025-31936· High 7.0

Not known to be exploited · CVSS 7.0 High.

Data as of 10/25/2026, 09:03:57 UTC

CVSS base score
7.0High
How severe the flaw is on the 0–10 CVSS scale.
Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.09% chance of exploitation in 30 days – higher than 0% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

What to do

Affected software

ProductAffectedFixed in
Red Hatredhat/microcode_ctlpkg:rpm/redhat/microcode_ctlOther threatsAffected
  • *
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A security update is available and should be applied to affected systems. Red Hat has released updated microcode_ctl packages containing the necessary microcode updates to address these vulnerabilities. Users should follow the vendor's official guidance to apply these updates. For Red Hat Enterprise Linux 8, refer to https://access.redhat.com/articles/11258 for update instructions. Applying the update mitigates the vulnerabilities by correcting improper value and memory range handling in privileged CPU modes.

Description

Multiple privilege escalation vulnerabilities affecting Intel processors are addressed by a security update to the ucode-intel microcode package. These vulnerabilities involve improper value and memory range handling in privileged CPU modes, specifically Ring 0 and System Management Mode (SMM). The update is available for SUSE and Red Hat Enterprise Linux distributions, including microcode releases up to 20260812. The vulnerabilities are identified as CVE-2025-31936 and CVE-2025-35973. The update fixes these issues by providing updated microcode and related packages.

Impact

Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges within the processor's most privileged execution modes (Ring 0 and SMM). This could potentially lead to unauthorized control over the system at a very low level. However, there are no known exploits in the wild at this time. The vulnerabilities affect Intel processors and impact systems running affected versions of Red Hat Enterprise Linux and SUSE Linux Enterprise.

Weaknesses

References

Community reviews

Loading reviews…