{"id":"CVE-2026-31590","state":"PUBLISHED","title":"KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION\n\nDrop the WARN in sev_pin_memory() on npages overflowing an int, as the\nWARN is comically trivially to trigger from userspace, e.g. by doing:\n\n  struct kvm_enc_region range = {\n          .addr = 0,\n          .size = -1ul,\n  };\n\n  __vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, &range);\n\nNote, the checks in sev_mem_enc_register_region() that presumably exist to\nverify the incoming address+size are completely worthless, as both \"addr\"\nand \"size\" are u64s and SEV is 64-bit only, i.e. they _can't_ be greater\nthan ULONG_MAX.  That wart will be cleaned up in the near future.\n\n\tif (range->addr > ULONG_MAX || range->size > ULONG_MAX)\n\t\treturn -EINVAL;\n\nOpportunistically add a comment to explain why the code calculates the\nnumber of pages the \"hard\" way, e.g. instead of just shifting @ulen.","publishedAt":"2026-04-24T14:42:17.629Z","updatedAt":"2026-06-14T17:42:30.901Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"6a8e3c82122737529b25ef2a048fbcc569d8c055","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"a703933bcfa5cc76ca10e2048464600e74136099","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"abcd43ff579abd0a654bb4636086e78819dd5f4c","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"b670833749ffd8681361db2bb047c6f2e3075f3a","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"ab423e5892826202a660b5ac85d1125b0e8301a5","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"28cc13ca20431b127d42d84ba10898d03e2c8267","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"c29ff288a2d97a6f4640a498a367cf0eb91312eb","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"1cba4dcd795daf6d257122779fb6a349edf03914","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"8acffeef5ef720c35e513e322ab08e32683f32f2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kvm/svm/sev.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.9","versionType":"semver"},{"version":"5.10.258","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.136","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.83","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.24","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.14","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0.1","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kvm/svm/sev.c"]}],"references":["https://git.kernel.org/stable/c/6a8e3c82122737529b25ef2a048fbcc569d8c055","https://git.kernel.org/stable/c/a703933bcfa5cc76ca10e2048464600e74136099","https://git.kernel.org/stable/c/abcd43ff579abd0a654bb4636086e78819dd5f4c","https://git.kernel.org/stable/c/b670833749ffd8681361db2bb047c6f2e3075f3a","https://git.kernel.org/stable/c/ab423e5892826202a660b5ac85d1125b0e8301a5","https://git.kernel.org/stable/c/28cc13ca20431b127d42d84ba10898d03e2c8267","https://git.kernel.org/stable/c/c29ff288a2d97a6f4640a498a367cf0eb91312eb","https://git.kernel.org/stable/c/1cba4dcd795daf6d257122779fb6a349edf03914","https://git.kernel.org/stable/c/8acffeef5ef720c35e513e322ab08e32683f32f2"],"weaknesses":[],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/31xxx/CVE-2026-31590.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31590","state":"PUBLISHED","datePublished":"2026-04-24T14:42:17.629Z","dateUpdated":"2026-06-14T17:42:30.901Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-03-09T15:48:24.120Z"},"containers":{"cna":{"title":"KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION\n\nDrop the WARN in sev_pin_memory() on npages overflowing an int, as the\nWARN is comically trivially to trigger from userspace, e.g. by doing:\n\n  struct kvm_enc_region range = {\n          .addr = 0,\n          .size = -1ul,\n  };\n\n  __vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, &range);\n\nNote, the checks in sev_mem_enc_register_region() that presumably exist to\nverify the incoming address+size are completely worthless, as both \"addr\"\nand \"size\" are u64s and SEV is 64-bit only, i.e. they _can't_ be greater\nthan ULONG_MAX.  That wart will be cleaned up in the near future.\n\n\tif (range->addr > ULONG_MAX || range->size > ULONG_MAX)\n\t\treturn -EINVAL;\n\nOpportunistically add a comment to explain why the code calculates the\nnumber of pages the \"hard\" way, e.g. instead of just shifting @ulen."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"6a8e3c82122737529b25ef2a048fbcc569d8c055","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"a703933bcfa5cc76ca10e2048464600e74136099","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"abcd43ff579abd0a654bb4636086e78819dd5f4c","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"b670833749ffd8681361db2bb047c6f2e3075f3a","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"ab423e5892826202a660b5ac85d1125b0e8301a5","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"28cc13ca20431b127d42d84ba10898d03e2c8267","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"c29ff288a2d97a6f4640a498a367cf0eb91312eb","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"1cba4dcd795daf6d257122779fb6a349edf03914","versionType":"git"},{"version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","status":"affected","lessThan":"8acffeef5ef720c35e513e322ab08e32683f32f2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kvm/svm/sev.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.9","versionType":"semver"},{"version":"5.10.258","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.136","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.83","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.24","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.14","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0.1","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kvm/svm/sev.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6a8e3c82122737529b25ef2a048fbcc569d8c055"},{"url":"https://git.kernel.org/stable/c/a703933bcfa5cc76ca10e2048464600e74136099"},{"url":"https://git.kernel.org/stable/c/abcd43ff579abd0a654bb4636086e78819dd5f4c"},{"url":"https://git.kernel.org/stable/c/b670833749ffd8681361db2bb047c6f2e3075f3a"},{"url":"https://git.kernel.org/stable/c/ab423e5892826202a660b5ac85d1125b0e8301a5"},{"url":"https://git.kernel.org/stable/c/28cc13ca20431b127d42d84ba10898d03e2c8267"},{"url":"https://git.kernel.org/stable/c/c29ff288a2d97a6f4640a498a367cf0eb91312eb"},{"url":"https://git.kernel.org/stable/c/1cba4dcd795daf6d257122779fb6a349edf03914"},{"url":"https://git.kernel.org/stable/c/8acffeef5ef720c35e513e322ab08e32683f32f2"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-06-14T17:42:30.901Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"5.10.258"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"6.6.136"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"6.12.83"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"6.18.24"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"6.19.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"7.0.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}