CVE-2026-31590

MEDIUM EPSS 2.6%
Published Apr 24, 20262mo ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Apr 24, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION Drop the WARN in sev_pin_memory() on npages overflowing an int, as the WARN is comically trivially to trigger from userspace, e.g. by doing: struct kvm_enc_region range = { .addr = 0, .size = -1ul, }; __vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, &range); Note, the checks in sev_mem_enc_register_region() that presumably exist to verify the incoming address+size are completely worthless, as both "addr" and "size" are u64s and SEV is 64-bit only, i.e. they _can't_ be greater than ULONG_MAX. That wart will be cleaned up in the near future. if (range->addr > ULONG_MAX || range->size > ULONG_MAX) return -EINVAL; Opportunistically add a comment to explain why the code calculates the number of pages the "hard" way, e.g. instead of just shifting @ulen.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
2.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 5

VendorProductVersionRange
linuxlinux_kernel*≥5.9  –  <6.6.136
linuxlinux_kernel*≥6.7  –  <6.12.83
linuxlinux_kernel*≥6.13  –  <6.18.24
linuxlinux_kernel*≥6.19  –  <6.19.14
linuxlinux_kernel*≥7.0  –  <7.0.1

References 9

  • git.kernel.org https://git.kernel.org/stable/c/1cba4dcd795daf6d257122779fb6a349edf03914
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/28cc13ca20431b127d42d84ba10898d03e2c8267
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6a8e3c82122737529b25ef2a048fbcc569d8c055
  • git.kernel.org https://git.kernel.org/stable/c/8acffeef5ef720c35e513e322ab08e32683f32f2
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a703933bcfa5cc76ca10e2048464600e74136099
  • git.kernel.org https://git.kernel.org/stable/c/ab423e5892826202a660b5ac85d1125b0e8301a5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/abcd43ff579abd0a654bb4636086e78819dd5f4c
  • git.kernel.org https://git.kernel.org/stable/c/b670833749ffd8681361db2bb047c6f2e3075f3a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c29ff288a2d97a6f4640a498a367cf0eb91312eb
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/1cba4dcd795daf6d257122779fb6a349edf03914
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/28cc13ca20431b127d42d84ba10898d03e2c8267
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8acffeef5ef720c35e513e322ab08e32683f32f2
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ab423e5892826202a660b5ac85d1125b0e8301a5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b670833749ffd8681361db2bb047c6f2e3075f3a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c29ff288a2d97a6f4640a498a367cf0eb91312eb
    Patch