CVE-2026-31590: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31590 is an integer overflow vulnerability in the Linux kernel's KVM (Kernel Virtual Machine) subsystem, specifically within the SEV (Secure Encrypted Virtualization) memory encryption handling in the sev_pin_memory() function. The flaw is triggered when processing the KVM_MEMORY_ENCRYPT_REG_REGION ioctl call with a crafted memory region size, causing the page count (npages) to overflow an integer. Affected Linux kernel versions span from 5.9 up to (excluding) 6.6.136, 6.7–6.12.83, 6.13–6.18.24, 6.19–6.19.14, and 7.0–7.0.1. It was published on April 24, 2026, with patches added to stable branches through late April and June 2026. The CVSS v3.1 base score is 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an integer overflow (CWE-190) in sev_pin_memory() within the Linux kernel's KVM SEV subsystem. When a userspace process issues a KVM_MEMORY_ENCRYPT_REG_REGION ioctl with a crafted size field (e.g., size = -1ul, the maximum u64 value), the calculation of the number of pages (npages) overflows a signed integer, triggering a kernel WARN. The existing bounds checks in sev_mem_enc_register_region() — comparing addr and size against ULONG_MAX — are ineffective because both fields are u64 types on a 64-bit-only platform and can never exceed ULONG_MAX. Exploitation requires only local access with low privileges and no user interaction, as any process with access to the KVM device can issue the malformed ioctl (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows a local attacker with low privileges to trigger repeated kernel WARN messages, resulting in denial of service through warning spam, system resource exhaustion, and performance degradation in virtualized environments using AMD SEV. The vulnerability has no confidentiality or integrity impact — only availability is affected. The impact is primarily limited to KVM/SEV-enabled hypervisor hosts; guest virtual machines and non-SEV configurations are not directly affected (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The vulnerability is trivially triggerable by any local user with access to the KVM device, requiring only a simple ioctl call with a crafted kvm_enc_region structure. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat Bugzilla).

1. Precondition: Obtain local access to a Linux system running a vulnerable kernel version (5.9–6.6.135, 6.7–6.12.82, 6.13–6.18.23, 6.19–6.19.13, or 7.0.0) with KVM and AMD SEV enabled, and with access to the /dev/kvm device.
2. Craft malicious ioctl payload: Construct a kvm_enc_region structure with addr = 0 and size = -1ul (maximum u64 value, i.e., 0xFFFFFFFFFFFFFFFF).
3. Issue the ioctl: Call ioctl(vm_fd, KVM_MEMORY_ENCRYPT_REG_REGION, &range) against an open KVM VM file descriptor, triggering sev_pin_memory() with the oversized region.
4. Trigger integer overflow: The page count calculation in sev_pin_memory() overflows a signed integer, causing the kernel to emit a WARN (kernel warning/stack trace).
5. Repeat for DoS: Repeatedly issue the ioctl to flood the kernel log with warnings, exhausting system resources and degrading performance on the hypervisor host (GitHub Advisory).

• Logs: Repeated kernel WARN messages or stack traces in /var/log/kern.log or dmesg output referencing sev_pin_memory() or KVM_MEMORY_ENCRYPT_REG_REGION; unusual volume of kernel warning entries in a short time window.
• Process: Unexpected or repeated ioctl calls to KVM device (/dev/kvm) from unprivileged processes; processes issuing KVM_MEMORY_ENCRYPT_REG_REGION with anomalously large size values.
• System: Elevated CPU usage or system slowdown on KVM hypervisor hosts without corresponding guest workload increase; kernel log buffer filling rapidly with warning messages.

Update the Linux kernel to a patched version: 6.6.136 or later (for the 5.9–6.6 branch), 6.12.83 or later (6.7–6.12 branch), 6.18.24 or later (6.13–6.18 branch), 6.19.14 or later (6.19 branch), or 7.0.1 or later (7.0 branch). Patches are available as stable commits on kernel.org. As a temporary workaround, restrict access to the KVM device (/dev/kvm) to trusted users only, and disable KVM SEV features if not required for the infrastructure. Monitor kernel logs for anomalous WARN messages related to KVM memory encryption operations (GitHub Advisory, Red Hat Bugzilla).