CVE-2026-31569: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31569 Overview

CVE-2026-31569 is an Out-of-Bounds Read vulnerability in the Linux kernel affecting the LoongArch KVM (Kernel-based Virtual Machine) subsystem. The vulnerability exists in the eiointc_update_sw_coremap() function where the EIOINTC's coremap can be empty, leading to an invalid cpuid value of -1 being used. This results in an out-of-bounds access to the kvm_arch::phyid_map::phys_map[] array.

When the coremap is empty, the function incorrectly returns a cpuid of -1 instead of the expected value of 0. Since the behavior should be similar to cases where cpuid >= 4, the code fails to handle this edge case properly, creating an exploitable memory safety issue.

Critical Impact
Local attackers with low privileges can exploit this vulnerability to read sensitive kernel memory or cause a denial of service condition, potentially escaping VM boundaries in virtualized environments.

Affected Products

Linux Kernel versions prior to patched releases
Linux Kernel 6.13
Linux Kernel 7.0 rc1 through rc7

Discovery Timeline

April 24, 2026 - CVE-2026-31569 published to NVD
April 27, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31569

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-bounds Read) and affects the LoongArch architecture's KVM virtualization implementation. The flaw resides in the Extended I/O Interrupt Controller (EIOINTC) component, which is responsible for managing interrupt routing in virtualized LoongArch environments.

The core issue lies in the eiointc_update_sw_coremap() function's handling of empty coremap scenarios. When processing interrupt mappings, the function attempts to determine the target CPU for interrupt delivery. However, when the coremap contains no valid entries, the function returns an uninitialized or default value of -1 for the cpuid.

This negative cpuid value is then used as an array index into kvm_arch::phyid_map::phys_map[], which expects only non-negative indices. The resulting out-of-bounds read can expose adjacent kernel memory contents or trigger a system crash depending on the memory layout and access patterns.

Root Cause

The root cause is improper boundary checking in the eiointc_update_sw_coremap() function. When the EIOINTC coremap is empty (contains no mapped CPUs), the function fails to handle this edge case gracefully. Instead of returning a safe default value of 0 (which would match the behavior for cpuid >= 4), it returns -1, leading to the array index underflow.

The fix involves ensuring that when the coremap is empty, the function returns 0 instead of -1, treating the empty coremap case consistently with other boundary conditions where cpuid values exceed valid ranges.

Attack Vector

The attack vector is local, requiring the attacker to have low-privilege access to a system running the vulnerable Linux kernel on LoongArch architecture with KVM enabled. The attacker can trigger the vulnerability by:

Creating or manipulating a KVM virtual machine on an affected LoongArch system
Crafting specific interrupt controller configurations that result in an empty coremap
Triggering the eiointc_update_sw_coremap() function to process the empty coremap
The resulting out-of-bounds read can leak kernel memory information or cause a denial of service

The vulnerability does not require user interaction and can affect the confidentiality of data in the host kernel while also impacting system availability through potential crashes.

Detection Methods for CVE-2026-31569

Indicators of Compromise

Unexpected kernel panics or crashes on LoongArch systems running KVM
Kernel log entries indicating array bounds violations in the KVM subsystem
Anomalous memory access patterns in the EIOINTC interrupt controller code paths
Virtual machine guest systems experiencing unexpected failures during interrupt processing

Detection Strategies

Monitor kernel logs for oops messages referencing eiointc_update_sw_coremap or related KVM LoongArch functions
Deploy kernel address sanitizer (KASAN) on development systems to detect out-of-bounds memory accesses
Implement runtime bounds checking for array accesses in virtualization code paths
Use static analysis tools to identify similar array index validation issues in kernel code

Monitoring Recommendations

Enable kernel crash dump collection to capture forensic evidence of exploitation attempts
Configure audit rules to monitor KVM virtual machine creation and configuration changes
Set up alerts for repeated kernel crashes or memory violations on LoongArch virtualization hosts
Monitor for unusual patterns in VM interrupt handling behavior

How to Mitigate CVE-2026-31569

Immediate Actions Required

Update the Linux kernel to a patched version that includes the fix for CVE-2026-31569
If patching is not immediately possible, consider disabling KVM on affected LoongArch systems
Restrict access to KVM functionality to trusted users only
Monitor systems for signs of exploitation while awaiting patch deployment

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix ensures that when EIOINTC's coremap is empty, the function correctly returns 0 instead of -1, preventing the out-of-bounds array access.

Patches are available through the following kernel git commits:

System administrators should update to the latest stable kernel version that includes these commits or apply the patches to their current kernel builds.

Workarounds

Disable KVM virtualization on LoongArch systems until patches can be applied
Restrict local user access to KVM devices (/dev/kvm) using system permissions
Implement mandatory access controls (SELinux/AppArmor) to limit which processes can interact with KVM
Consider migrating virtualization workloads to non-LoongArch systems temporarily if patching is delayed

bash

# Restrict access to KVM device to root only
chmod 600 /dev/kvm

# Verify KVM module is not loaded (temporary mitigation)
lsmod | grep kvm

# Unload KVM modules if immediate mitigation is required
rmmod kvm_loongarch
rmmod kvm