Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-31558

LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust

Description

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust kvm_get_vcpu_by_cpuid() takes a cpuid parameter whose type is int, so cpuid can be negative. Let kvm_get_vcpu_by_cpuid() return NULL for this case so as to make it more robust. This fix an out-of-bounds access to kvm_arch::phyid_map::phys_map[].

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 73516e9da512adc63ba3859fbd82a21f6257348f to < 596c3f8069c4792f22fce8c4452f44410032d910affected
  • 73516e9da512adc63ba3859fbd82a21f6257348f to < 878cf6acb4fd8ab4126cf9d369a5bb0e23123418affected
  • 73516e9da512adc63ba3859fbd82a21f6257348f to < 47857b05bd50db01e211a1b6f513d57901cd3e6baffected
  • 73516e9da512adc63ba3859fbd82a21f6257348f to < 2db06c15d8c7a0ccb6108524e16cd9163753f354affected

Linux Linux

Default version status: affected

  • 6.10affected
  • 0 to < 6.10unaffected
  • 6.12.80 to ≤ 6.12.*unaffected
  • 6.18.21 to ≤ 6.18.*unaffected
  • 6.19.11 to ≤ 6.19.*unaffected
  • 7.0 to ≤ *unaffected

References