CVE-2026-31564

A vulnerability has been discovered in the Linux kernel affecting the LoongArch KVM implementation. In the function kvm_eiointc_regs_access(), the register base address calculation is performed incorrectly. The code computes an offset from an array base address, but fails to cast the base address (a u64 value) to a void * pointer before adding the offset [1]. This results in the offset being applied to the integer representation rather than the memory address, causing the function to access the wrong memory location [1].

Exploitation

To exploit this bug, an attacker would require the ability to trigger the affected code path within a LoongArch KVM guest, which typically involves accessing certain emulated device registers. The vulnerability does not require special privileges beyond those needed to interact with the KVM virtual device [1]. The attacker must be able to influence the register offset that is passed to kvm_eiointc_regs_access() [1].

Impact

An incorrect base address calculation could cause the KVM hypervisor to read or write to unintended memory locations. This may lead to information disclosure (reading sensitive kernel data) or a denial of service (crash or corruption of kernel structures) [1]. The CVSS v3 score of 5.5 (Medium) reflects the potential for moderate impact with local access required.

Mitigation

The fix is included in the Linux kernel stable trees, as committed in [1]. System administrators should apply the latest kernel updates to ensure the corrected pointer arithmetic is in place. No workarounds are documented, but the vulnerability is patched.