CVE-2026-31558: LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: KVM: Make kvmgetvcpubycpuid() more robust
kvmgetvcpubycpuid() takes a cpuid parameter whose type is int, so cpuid can be negative. Let kvmgetvcpubycpuid() return NULL for this case so as to make it more robust.
This fix an out-of-bounds access to kvmarch::phyidmap::physmap[].
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31558?
CVE-2026-31558 has been classified with a medium severity due to its potential impact on system stability.
How do I fix CVE-2026-31558?
To fix CVE-2026-31558, update to the latest version of the Linux kernel where the vulnerability has been addressed.
What is affected by CVE-2026-31558?
CVE-2026-31558 affects the Linux kernel implementations that use the KVM virtualization technology.
What does CVE-2026-31558 exploit?
CVE-2026-31558 exploits a robustness issue in the kvm_get_vcpu_by_cpuid() function in the Linux kernel.
Is there a workaround for CVE-2026-31558?
Currently, there are no specific workarounds for CVE-2026-31558; applying the patch is the recommended course of action.