CVE-2026-63940 KVM: SEV: Ignore Port I/O requests of length '0'

Critical 9.3 Published 19 Jul 2026 Updated 21 Oct 2026

An integer underflow in KVM SEV handling of zero-length Port I/O requests can lead to a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-63940?

CVE-2026-63940 is a critical vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Ignore Port I/O requests of length '0'

Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.

Weakness: CWE-191, CWE-190

Which versions are affected by CVE-2026-63940?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-63940?

Apply the vendor's patch.

Is CVE-2026-63940 being exploited?

There is no known exploitation of CVE-2026-63940 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as AZL-92766, BELL-CVE-2026-63940, DEBIAN-CVE-2026-63940, GHSA-jx39-q92m-wf39, ROOT-OS-DEBIAN-12-CVE-2026-63940, ROOT-OS-UBUNTU-2204-CVE-2026-63940 and 1 more.