CVE-2026-31590

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION

Drop the WARN in sev_pin_memory() on npages overflowing an int, as the

WARN is comically trivially to trigger from userspace, e.g. by doing:

struct kvm_enc_region range = {

.addr = 0,

.size = -1ul,

};

__vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, &range);

Note, the checks in sev_mem_enc_register_region() that presumably exist to

verify the incoming address+size are completely worthless, as both "addr"

and "size" are u64s and SEV is 64-bit only, i.e. they _can't_ be greater

than ULONG_MAX. That wart will be cleaned up in the near future.

if (range->addr > ULONG_MAX || range->size > ULONG_MAX)

return -EINVAL;

Opportunistically add a comment to explain why the code calculates the

number of pages the "hard" way, e.g. instead of just shifting @ulen.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References