CVE-2026-31558: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31558 is an out-of-bounds read vulnerability in the Linux kernel's LoongArch KVM subsystem, specifically in the kvm_get_vcpu_by_cpuid() function. The function accepts a cpuid parameter of type int, which can be negative, and without a minimum value check, a negative value causes an out-of-bounds access to the kvm_arch::phyid_map::phys_map[] array. Affected Linux kernel versions include 6.10, 6.10.1–6.12.79, 6.13–6.18.20, 6.19–6.19.10, and 7.0-rc1 through 7.0-rc7. The vulnerability was published on April 24, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 8.8 (High), assigned by kernel.org (Feedly, NVD).

The root cause is classified as CWE-839 (Numeric Range Comparison Without Minimum Check) and CWE-125 (Out-of-bounds Read). The kvm_get_vcpu_by_cpuid() function in the LoongArch KVM implementation uses the cpuid integer parameter directly as an array index into kvm_arch::phyid_map::phys_map[] without validating that it is non-negative. A local attacker with low privileges who can interact with the KVM interface can supply a negative cpuid value, causing the kernel to read memory at an address before the start of the array. The fix adds a NULL return for negative cpuid inputs, preventing the invalid array access (Feedly, NVD).

Successful exploitation can result in high confidentiality, integrity, and availability impacts, including potential memory corruption of the hypervisor and exposure of sensitive kernel memory across guest virtual machines. The changed scope (S:C) in the CVSS vector indicates that the impact can extend beyond the vulnerable component to affect other guest VMs running on the same host. In multi-tenant virtualization environments, this could enable an attacker to read sensitive data from other guests or destabilize the hypervisor, leading to denial of service (Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges on a LoongArch system running an affected kernel with KVM enabled. The EPSS score is approximately 0.018%, reflecting a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Patches are available in the following Linux kernel versions: 6.12.80, 6.18.21, 6.19.11, and 7.0-rc1 and later. Patch commits are available at git.kernel.org for all affected stable branches. As an interim measure where immediate patching is not feasible, administrators should restrict KVM access to trusted users only and implement additional access controls to limit local privilege escalation vectors. This vulnerability is specific to LoongArch KVM implementations; non-LoongArch systems are not affected (Feedly, NVD).