Skip to main content

Linux Kernel CVE-2026-31564

| EUVDEUVD-2026-25457 MEDIUM
2026-04-24 Linux GHSA-2xxh-f2h8-792v
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector confirmed by architecture-gated KVM host access; PR:L for guest operator; pure kernel-crash DoS with no confidentiality or integrity impact per description.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:11 vuln.today
CVSS changed
Apr 27, 2026 - 20:37 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:31 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25457
CVE Published
Apr 24, 2026 - 14:35 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Fix base address calculation in kvm_eiointc_regs_access()

In function kvm_eiointc_regs_access(), the register base address is caculated from array base address plus offset, the offset is absolute value from the base address. The data type of array base address is u64, it should be converted into the "void *" type and then plus the offset.

AnalysisAI

Pointer arithmetic type confusion in the Linux kernel's LoongArch KVM EIOINTC register access handler allows a local low-privileged attacker to crash the host kernel. The function kvm_eiointc_regs_access() stores the register array base address as a u64 rather than a void pointer, causing byte offsets to be scaled incorrectly during address calculation and producing out-of-bounds memory accesses that result in a kernel panic. No public exploit code exists and EPSS sits at 0.02%, consistent with the narrow LoongArch KVM attack surface; the vulnerability is not listed in CISA KEV.

Technical ContextAI

The Extended I/O Interrupt Controller (EIOINTC) is a hardware interrupt controller native to the LoongArch ISA developed by Loongson Technology. The Linux KVM hypervisor emulates EIOINTC for LoongArch guests via kvm_eiointc_regs_access(). The root cause is improper C pointer arithmetic: the array base address is declared as u64, so adding a byte offset applies integer arithmetic and multiplies the offset by sizeof(u64)=8, directing accesses to an address eight times further into memory than intended. Correcting the type to void * ensures the compiler applies single-byte pointer scaling. No CWE is formally assigned, but this is functionally equivalent to CWE-468 (Incorrect Pointer Scaling). The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* identifies the upstream Linux kernel; downstream distributions Red Hat and SUSE are noted as carrying the affected LoongArch-enabled kernel builds. This vulnerability is architecturally gated - only LoongArch (Loongson) hardware running KVM is affected.

RemediationAI

Upgrade the Linux kernel to version 6.19.11 (stable) or 7.0 (mainline), which include the validated fix commits available at https://git.kernel.org/stable/c/c4f0a9481cf0dd7c71a07484bc98f2570fdb3a82 and https://git.kernel.org/stable/c/6bcfb7f46d667b04bd1a1169ccedf5fb699c60df. Red Hat and SUSE users should monitor vendor security advisories for distribution-packaged updates to their LoongArch kernel builds. If immediate patching is not feasible on LoongArch KVM hosts, a targeted compensating control is to restrict or disable untrusted KVM guest tenants - eliminating the trigger path entirely at the cost of reduced multi-tenant VM capability. There is no viable per-feature toggle to disable only EIOINTC emulation without broader guest functionality impact, so the primary mitigation remains the vendor patch.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31564 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy