CVE-2026-31558

LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust

High · published April 24, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust

kvm_get_vcpu_by_cpuid() takes a cpuid parameter whose type is int, so

cpuid can be negative. Let kvm_get_vcpu_by_cpuid() return NULL for this

case so as to make it more robust.

This fix an out-of-bounds access to kvm_arch::phyid_map::phys_map[].

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00175 · 6.7th percentile
Published
2026-04-24T14:35Z
EPSS history
Timeline
  • 24 APR 14:35Z
    LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust
    cvelistv5