CVE-2026-31558

LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust

State: Published
Severity: 8.8 High
Published: Apr 24, 2026
Updated: Aug 5, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust

kvm_get_vcpu_by_cpuid() takes a cpuid parameter whose type is int, so cpuid can be negative. Let kvm_get_vcpu_by_cpuid() return NULL for this case so as to make it more robust.

This fix an out-of-bounds access to kvm_arch::phyid_map::phys_map[].

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	73516e9da512adc63ba3859fbd82a21f6257348f to before 596c3f8069c4792f22fce8c4452f44410032d910Affected 73516e9da512adc63ba3859fbd82a21f6257348f to before 878cf6acb4fd8ab4126cf9d369a5bb0e23123418Affected 73516e9da512adc63ba3859fbd82a21f6257348f to before 47857b05bd50db01e211a1b6f513d57901cd3e6bAffected 73516e9da512adc63ba3859fbd82a21f6257348f to before 2db06c15d8c7a0ccb6108524e16cd9163753f354Affected
LinuxLinux	6.10Affected before 6.10Not affected 6.12.80 through 6.12.Not affected 6.18.21 through 6.18.Not affected 6.19.11 through 6.19.*Not affected 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.