{"id":"CVE-2026-31590","title":"KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION\n\nDrop the WARN in sev_pin_memory() on npages overflowing an int, as the\nWARN is comically trivially …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < 6a8e3c82122737529b25ef2a048fbcc569d8c055","Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < a703933bcfa5cc76ca10e2048464600e74136099","Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < abcd43ff579abd0a654bb4636086e78819dd5f4c","Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < b670833749ffd8681361db2bb047c6f2e3075f3a","Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < ab423e5892826202a660b5ac85d1125b0e8301a5","Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < 28cc13ca20431b127d42d84ba10898d03e2c8267","Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < c29ff288a2d97a6f4640a498a367cf0eb91312eb","Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < 1cba4dcd795daf6d257122779fb6a349edf03914","Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < 8acffeef5ef720c35e513e322ab08e32683f32f2","Linux 5.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:22:14.418696Z"},"published":"2026-04-24","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:32:18.788Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31590","references":[{"url":"https://git.kernel.org/stable/c/6a8e3c82122737529b25ef2a048fbcc569d8c055"},{"url":"https://git.kernel.org/stable/c/a703933bcfa5cc76ca10e2048464600e74136099"},{"url":"https://git.kernel.org/stable/c/abcd43ff579abd0a654bb4636086e78819dd5f4c"},{"url":"https://git.kernel.org/stable/c/b670833749ffd8681361db2bb047c6f2e3075f3a"},{"url":"https://git.kernel.org/stable/c/ab423e5892826202a660b5ac85d1125b0e8301a5"},{"url":"https://git.kernel.org/stable/c/28cc13ca20431b127d42d84ba10898d03e2c8267"},{"url":"https://git.kernel.org/stable/c/c29ff288a2d97a6f4640a498a367cf0eb91312eb"},{"url":"https://git.kernel.org/stable/c/1cba4dcd795daf6d257122779fb6a349edf03914"},{"url":"https://git.kernel.org/stable/c/8acffeef5ef720c35e513e322ab08e32683f32f2"}],"tags":["cve.org"],"epss":0.00125,"epssPercentile":0.02236,"ingestedAt":"2026-11-06T15:54:04.058Z","slug":"CVE-2026-31590","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION\n\nDrop the WARN in sev_pin_memory() on npages overflowing an int, as the\nWARN is comically trivially to trigger from userspace, e.g. by doing:\n\n  struct kvm_enc_region range = {\n          .addr = 0,\n          .size = -1ul,\n  };\n\n  __vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, &range);\n\nNote, the checks in sev_mem_enc_register_region() that presumably exist to\nverify the incoming address+size are completely worthless, as both \"addr\"\nand \"size\" are u64s and SEV is 64-bit only, i.e. they _can't_ be greater\nthan ULONG_MAX.  That wart will be cleaned up in the near future.\n\n\tif (range->addr > ULONG_MAX || range->size > ULONG_MAX)\n\t\treturn -EINVAL;\n\nOpportunistically add a comment to explain why the code calculates the\nnumber of pages the \"hard\" way, e.g. instead of just shifting @ulen.\n\n## Affected\n\n- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < 6a8e3c82122737529b25ef2a048fbcc569d8c055`\n- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < a703933bcfa5cc76ca10e2048464600e74136099`\n- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < abcd43ff579abd0a654bb4636086e78819dd5f4c`\n- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < b670833749ffd8681361db2bb047c6f2e3075f3a`\n- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < ab423e5892826202a660b5ac85d1125b0e8301a5`\n- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < 28cc13ca20431b127d42d84ba10898d03e2c8267`\n- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < c29ff288a2d97a6f4640a498a367cf0eb91312eb`\n- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < 1cba4dcd795daf6d257122779fb6a349edf03914`\n- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < 8acffeef5ef720c35e513e322ab08e32683f32f2`\n- `Linux 5.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}