CVE-2026-31590 KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
A local attacker can trigger a kernel warning and potential denial of service by passing an invalid size to the KVM memory encryption registration ioctl.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31590?
CVE-2026-31590 is a medium-severity denial of service vulnerability in Linux kernel, published on 24 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
Drop the WARN in sev_pin_memory() on npages overflowing an int, as the WARN is comically trivially to trigger from userspace, e.g. by doing:
struct kvm_enc_region range = { .addr = 0, .size = -1ul, };
__vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, &range);
Note, the checks in sev_mem_enc_register_region() that presumably exist to verify the incoming address+size are completely worthless, as both "addr" and "size" are u64s and SEV is 64-bit only, i.e. they _can't_ be greater than ULONG_MAX. That wart will be cleaned up in the near future.
if (range->addr > ULONG_MAX || range->size > ULONG_MAX) return -EINVAL;
Opportunistically add a comment to explain why the code calculates the number of pages the "hard" way, e.g. instead of just shifting @ulen.
Which versions are affected by CVE-2026-31590?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31590?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-31590 being exploited?
There is no known exploitation of CVE-2026-31590 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-83654, BELL-CVE-2026-31590, DEBIAN-CVE-2026-31590, GHSA-5gvm-8x7g-h7xx, ROOT-OS-DEBIAN-11-CVE-2026-31590, ROOT-OS-DEBIAN-12-CVE-2026-31590 and 4 more.