The Linux kernel vulnerability CVE-2026-31470 involves improper handling of the host-controlled 'quote' buffer length in the TDX guest driver. The host-controlled value `quote_buf->out_len` determines how many bytes of the attestation quote are copied to guest userspace. Without proper validation, the host could specify a length exceeding the guest's allocated buffer or modify the response concurrently, causing the guest to read memory beyond its allocation (up to TSM_REPORT_OUTBLOB_MAX). Since quotes in TDX remote attestation are not private and can be forwarded to attestation servers, this flaw could lead to unauthorized data disclosure, potentially crossing container isolation boundaries. The vulnerability affects Linux kernel versions prior to 6.8.0 and related builds. The issue has been addressed in updated kernel releases.

The vulnerability allows a local attacker controlling the host in a TDX environment to cause the guest to read memory beyond its allocated buffer, potentially leaking sensitive data. This could compromise confidentiality by exposing data across container boundaries or to attestation servers. The CVSS score of 7.1 indicates a medium severity with high confidentiality impact, no integrity impact, and high availability impact. There are no known exploits in the wild at this time.

An official patch is available and included in Linux kernel versions 6.8.0 and later, as well as related updated builds. Users should apply the latest kernel updates to remediate this vulnerability. After updating, a system reboot is required to apply the changes. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. Follow vendor guidance for updating and recompiling kernel modules. No additional mitigation steps are indicated by the vendor advisory.