CVE-2026-31558: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31558 Overview

CVE-2026-31558 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel's LoongArch Kernel-based Virtual Machine (KVM) subsystem. The flaw resides in kvm_get_vcpu_by_cpuid(), which accepts a cpuid parameter typed as a signed int. When callers pass a negative cpuid value, the function performs an out-of-bounds access to the kvm_arch::phyid_map::phys_map[] array. A local authenticated user with the ability to interact with KVM ioctls on a LoongArch host can trigger the condition. The Linux maintainers resolved the issue by returning NULL for negative cpuid values, making the lookup function more robust against invalid input.

Critical Impact
A local attacker with low privileges can trigger an out-of-bounds memory read in the LoongArch KVM hypervisor, leading to host memory disclosure, integrity loss, or denial of service across guest boundaries.

Affected Products

Linux kernel mainline 7.0 release candidates rc1 through rc7
Linux kernel 6.10 stable branch
Linux distributions shipping LoongArch KVM support prior to the fixing commits

Discovery Timeline

2026-04-24 - CVE-2026-31558 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31558

Vulnerability Analysis

The vulnerability exists in the LoongArch KVM implementation in the Linux kernel. The helper function kvm_get_vcpu_by_cpuid() resolves a virtual CPU identifier to a vCPU structure by indexing into kvm_arch::phyid_map::phys_map[]. Because the cpuid parameter is declared as a signed integer, a negative value passed by a caller bypasses upper-bound checks and produces a negative array index. Indexing an array with a negative offset causes the kernel to dereference memory preceding the phys_map[] allocation, resulting in an out-of-bounds read.

The scope change reflected in the CVSS vector indicates that exploitation crosses the guest-to-host trust boundary within the KVM hypervisor. A guest or local process with KVM access can influence the parameter that drives the lookup, which expands the impact beyond the original security domain.

Root Cause

The root cause is missing input validation on a signed integer index. The function never checks whether cpuid is less than zero before using it as an array index. Adjacent kernel memory contents are returned as if they were a valid vCPU pointer, which downstream code then dereferences. The upstream fix adds a guard that returns NULL when the supplied identifier is negative, eliminating the unsafe lookup path.

Attack Vector

The attack requires local access with low privileges on a LoongArch system running an affected kernel with KVM enabled. An attacker invokes KVM ioctls or operates from within a guest VM in a way that causes the host to call kvm_get_vcpu_by_cpuid() with a negative value. The resulting out-of-bounds read can disclose adjacent kernel memory, corrupt control flow when the bogus pointer is dereferenced, or crash the host kernel. No user interaction is required.

No public proof-of-concept or exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the upstream patches for the exact code paths: Kernel Git Commit 2db06c15 and Kernel Git Commit 878cf6ac.

Detection Methods for CVE-2026-31558

Indicators of Compromise

Unexpected kernel oops or panic messages referencing kvm_get_vcpu_by_cpuid or phys_map in dmesg and /var/log/kern.log.
KASAN reports flagging out-of-bounds reads in the LoongArch KVM subsystem on hosts compiled with sanitizers enabled.
Abnormal termination or unexpected behavior of KVM-managed guests on LoongArch hosts running unpatched kernels.

Detection Strategies

Inventory LoongArch hosts and identify any running kernel versions in the 6.10 line or 7.0 release candidates without the fixing commits applied.
Audit which local users and service accounts have access to /dev/kvm and the ability to issue KVM ioctls.
Correlate kernel crash telemetry with KVM ioctl activity from non-administrative users to surface attempted exploitation.

Monitoring Recommendations

Forward kernel logs and audit events to a centralized analytics platform and alert on KVM-related faults on LoongArch hosts.
Monitor process execution on virtualization hosts to detect unauthorized binaries interacting with /dev/kvm.
Track guest VM lifecycle anomalies, including unexpected reboots and host instability, that may indicate triggered out-of-bounds reads.

How to Mitigate CVE-2026-31558

Immediate Actions Required

Apply the upstream Linux kernel patches that add the negative cpuid guard to kvm_get_vcpu_by_cpuid() on all LoongArch hosts.
Update to a stable kernel release that incorporates commits 2db06c15, 47857b05, 596c3f80, and 878cf6ac.
Restrict access to /dev/kvm to trusted virtualization service accounts only.

Patch Information

The Linux kernel maintainers resolved CVE-2026-31558 by returning NULL from kvm_get_vcpu_by_cpuid() when the supplied cpuid is negative. Apply the fix from one of the following upstream commits: Kernel Git Commit 2db06c15, Kernel Git Commit 47857b05, Kernel Git Commit 596c3f80, and Kernel Git Commit 878cf6ac. Rebuild and redeploy the kernel, then reboot affected hosts to load the patched image.

Workarounds

Disable the LoongArch KVM module on hosts that do not require hardware-assisted virtualization until patches are deployed.
Tighten Linux capability and group membership controls so that only required administrators can open /dev/kvm.
Migrate critical workloads off unpatched LoongArch virtualization hosts to patched systems where possible.

bash

# Configuration example: verify patch level and restrict KVM access on LoongArch hosts
uname -r
modprobe -r kvm
chgrp kvm /dev/kvm
chmod 0660 /dev/kvm
getfacl /dev/kvm