CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Drop WARN on large size for KVMMEMORYENCRYPTREGREGION
Drop the WARN in sevpinmemory() on npages overflowing an int, as the WARN is comically trivially to trigger from userspace, e.g. by doing:
struct kvmencregion range = { .addr = 0, .size = -1ul, };
vmioctl(vm, KVMMEMORYENCRYPTREGREGION, &range);
Note, the checks in sevmemencregisterregion() that presumably exist to verify the incoming address+size are completely worthless, as both "addr" and "size" are u64s and SEV is 64-bit only, i.e. they can't be greater than ULONGMAX. That wart will be cleaned up in the near future.
if (range->addr > ULONGMAX || range->size > ULONGMAX) return -EINVAL;
Opportunistically add a comment to explain why the code calculates the number of pages the "hard" way, e.g. instead of just shifting @ulen.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.137.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
Who can trigger this issue?
A local attacker with low privileges who can issue the KVM_MEMORY_ENCRYPT_REG_REGION ioctl against a KVM VM can trigger the warning condition. The affected path is KVM's SEV memory-encryption region registration handling.
What input is used to trigger the condition?
The condition can be trivially triggered by supplying a region with address zero and an extremely large size, such as an unsigned size value of -1. This causes the calculated page count to overflow an int and previously generated a WARN.