CVE-2026-31569

Vulnerability

Overview

A flaw was discovered in the Linux kernel's KVM subsystem for the LoongArch architecture. The function eiointc_update_sw_coremap() in the EIOINTC (External I/O Interrupt Controller) emulation can encounter a situation where the coremap is empty. When this occurs, the code incorrectly derives a CPU ID of -1, which is then used as an index into the kvm_arch::phyid_map::phys_map[] array. This results in an out-of-bounds memory access [1].

Exploitation and

Impact

An attacker with the ability to trigger the empty coremap condition within a KVM guest on a LoongArch host could cause the KVM host to read or write memory outside the intended for other kernel structures. The out-of-bounds access can lead to a denial of service (system crash) or potentially information disclosure. The vulnerability is triggered during interrupt controller emulation, which is a routine part of guest operations, making it reachable from a guest VM [1].

Mitigation

The fix, which has been applied to the stable kernel tree, ensures that when the coremap is empty, the code uses a CPU ID of 0 instead of -1, preventing the out-of-bounds access. This patch is included in the referenced commits [1][2][3]. Users should update their Linux kernel to a version containing this fix to mitigate the vulnerability.