CVE-2026-63940CWE-190

CVE-2026-63940

Critical · published July 19, 2026

CVSS v3.1
9.3
EPSS
0%
Percentile
7.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Ignore Port I/O requests of length '0'

Explicitly ignore Port I/O requests of length '0' (or count '0'), so that

setting up the software scratch area (and other code) doesn't have to

worry about underflowing the length, and to allow for WARNing on trying

to configure the scratch area with len==0.

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00185 · 7.7th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-07-19T20:17Z
References (5)
https://git.kernel.org/stable/c/2254972d4d69e279ba4e87bf0968eb08ad0d3c92 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3988bd2723de407ae90fa7a6f6029b4e60238c58 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3b6035bc6bff20e89752ce4358bc4c9a9d5883f2 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bbd3a27e4f99fdcad82d12d79c04a95dff1ff70b · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c30cde934c7813b4e3069765dac64ce3d31e34f2 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 19 JUL 14:55Z
    KVM: SEV: Ignore Port I/O requests of length '0'
    cvelistv5