CVE-2026-31590

Vulnerability

Analysis

CVE-2026-31590 is a vulnerability in the Linux kernel's KVM subsystem for AMD SEV (Secure Encrypted Virtualization). The issue lies in the sev_pin_memory() function, which contains a WARN_ON that checks if the number of pages (npages) overflows an int. This warning is trivially triggerable from userspace by passing a very large size value (e.g., -1ul) to the KVM_MEMORY_ENCRYPT_REG_REGION ioctl [1][2]. The existing input validation in sev_mem_enc_register_region() is ineffective because both addr and size are u64 and SEV is 64-bit only, so the checks against ULONG_MAX are always false [1].

ExploitationAn attacker with access to the KVM device (e.g., a user with permission to create and manage VMs) can trigger the warning by issuing a crafted KVM_MEMORY_ENCRYPT_REG_REGION ioctl with a size field set to a value that causes npages to overflow. No special privileges beyond the ability to interact with KVM are required, and no authentication is needed beyond standard VM management permissions [1]. The attack surface is local, as the ioctl is only accessible from within the host system.

ImpactTriggering the

WARN_ON causes a kernel warning message to be printed to the console and potentially a kernel panic if panic_on_warn is set. While the warning itself does not directly corrupt memory or allow code execution, it can be used as a denial-of-service vector, especially in production environments where warnings may be treated as critical events. The vulnerability has a CVSS v3 score of 5.5 (Medium), reflecting its local nature and limited impact [1].

MitigationThe fix removes the problematic

WARN_ON and adds a comment explaining the page calculation. The patch has been applied to the stable kernel tree [1][2][3][4]. Users should update to a kernel version containing the commit 28cc13ca2043 or later. No workaround is available other than applying the patch.