CVE-2025-31944

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Race condition for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow a denial of service. Authorized adversary with a privileged user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Feb 10, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-319455.3An unauthenticated attacker can obtain other users' charger information.CVE-2025-319466.2Pixmeo OsiriX MD is vulnerable to a local use after free scenario, which could allow an attacker to locally import a crafted DICOM file andCVE-2025-319475.3Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated loCVE-2025-319483.3Improper input validation for some Intel(R) oneAPI Math Kernel Library before version 2025.2 within Ring 3: User Applications may allow a deCVE-2025-319495.3An authenticated attacker can obtain any plant name by knowing the plant ID.CVE-2025-31959.8A vulnerability, which was classified as critical, has been found in itsourcecode Online Blood Bank Management System 1.0. This issue affectCVE-2025-319505.3An unauthenticated attacker can obtain EV charger energy consumption information of other users.CVE-2025-319518.8HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input hCVE-2025-319527.1HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, iCVE-2025-319536.5HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unautCVE-2025-319544.3HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and iCVE-2025-319556.5HCL iAutomate is affected by a sensitive data exposure vulnerability. This issue may allow unauthorized access to sensitive information wit
CVE-2025-31944: Medium severity, CVSS 5.3 | Vulnix