CVE-2026-31588

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Use scratch field in MMIO fragment to hold small write values

When exiting to userspace to service an emulated MMIO write, copy the

to-be-written value to a scratch field in the MMIO fragment if the size

of the data payload is 8 bytes or less, i.e. can fit in a single chunk,

instead of pointing the fragment directly at the source value.

This fixes a class of use-after-free bugs that occur when the emulator

initiates a write using an on-stack, local variable as the source, the

write splits a page boundary, *and* both pages are MMIO pages. Because

KVM's ABI only allows for physically contiguous MMIO requests, accesses

that split MMIO pages are separated into two fragments, and are sent to

userspace one at a time. When KVM attempts to complete userspace MMIO in

response to KVM_RUN after the first fragment, KVM will detect the second

fragment and generate a second userspace exit, and reference the on-stack

v

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References