Skip to main content

Linux Kernel CVE-2026-31590

| EUVDEUVD-2026-25483 MEDIUM
2026-04-24 Linux GHSA-5gvm-8x7g-h7xx
Buffer Overflow Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

AV:L and PR:L confirmed by /dev/kvm access requirement; A:H reflects kernel panic potential under panic_on_warn; C:N and I:N because no memory disclosure or write primitive exists.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:00 vuln.today
CVSS changed
Apr 28, 2026 - 20:53 NVD
5.5 (MEDIUM)
Patch released
Apr 28, 2026 - 20:38 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25483
CVE Published
Apr 24, 2026 - 14:42 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION

Drop the WARN in sev_pin_memory() on npages overflowing an int, as the WARN is comically trivially to trigger from userspace, e.g. by doing:

struct kvm_enc_region range = { .addr = 0, .size = -1ul, };

__vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, &range);

Note, the checks in sev_mem_enc_register_region() that presumably exist to verify the incoming address+size are completely worthless, as both "addr" and "size" are u64s and SEV is 64-bit only, i.e. they _can't_ be greater than ULONG_MAX. That wart will be cleaned up in the near future.

if (range->addr > ULONG_MAX || range->size > ULONG_MAX) return -EINVAL;

Opportunistically add a comment to explain why the code calculates the number of pages the "hard" way, e.g. instead of just shifting @ulen.

AnalysisAI

Denial-of-service in the Linux kernel KVM SEV subsystem allows a local low-privileged user to trivially trigger a kernel WARN in sev_pin_memory() by submitting a crafted KVM_MEMORY_ENCRYPT_REG_REGION ioctl with an oversized region (e.g., size set to the maximum u64 value), causing npages to overflow a signed int. On kernels configured with panic_on_warn=1, this directly results in a kernel panic and full system crash. No public exploit has been identified at time of analysis and CISA has not added this to the KEV catalog, though the CVE description itself provides a working proof-of-concept reproducer.

Technical ContextAI

The affected code resides in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem, specifically in the AMD SEV (Secure Encrypted Virtualization) memory pinning path. When a guest VM owner calls the KVM_MEMORY_ENCRYPT_REG_REGION ioctl with a kvm_enc_region struct, the kernel's sev_pin_memory() function computes npages as an int derived from the user-supplied u64 size field. On 64-bit platforms, the upstream bounds check - validating addr and size against ULONG_MAX - is effectively a no-op because both fields are u64 and cannot exceed ULONG_MAX by definition, meaning arbitrarily large values pass through unchecked. This integer narrowing from u64 to int causes npages to wrap, hitting a WARN_ON macro. The CVE is tagged Buffer Overflow, though the precise root cause is integer overflow/narrowing (closer to CWE-190 or CWE-617 Reachable Assertion) rather than a classic memory buffer overrun. CPE cpe:2.3:a:linux:linux:* confirms all Linux kernel versions prior to the patch commits are in scope.

RemediationAI

Upgrade to a patched Linux kernel release: 6.12.83, 6.18.24, 6.19.14, or 7.0.1, as documented by EUVD-2026-25483 and kernel.org stable commits. Ubuntu users should apply the update referenced in USN-8488-1 at https://ubuntu.com/security/notices/USN-8488-1. For systems where immediate kernel upgrade is not feasible, compensating controls include: restricting access to /dev/kvm to only trusted users and administrators (removes the PR:L attack surface entirely - side effect is blocking all unprivileged VM creation); disabling KVM module loading via modprobe blacklist if virtualization is not required (trade-off: disables all KVM-based workloads); and ensuring panic_on_warn=0 is set in kernel boot parameters (limits DoS to a logged warning rather than a crash, though memory pinning behavior may still be incorrect). The most actionable immediate mitigation for non-hypervisor hosts is confirming panic_on_warn is not enabled.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31590 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy