---
id: CVE-2026-31590
title: 'KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION

  Drop the WARN in sev_pin_memory() on npages overflowing an int, as the
  WARN is comically trivially …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 <
    6a8e3c82122737529b25ef2a048fbcc569d8c055
  - >-
    Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 <
    a703933bcfa5cc76ca10e2048464600e74136099
  - >-
    Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 <
    abcd43ff579abd0a654bb4636086e78819dd5f4c
  - >-
    Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 <
    b670833749ffd8681361db2bb047c6f2e3075f3a
  - >-
    Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 <
    ab423e5892826202a660b5ac85d1125b0e8301a5
  - >-
    Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 <
    28cc13ca20431b127d42d84ba10898d03e2c8267
  - >-
    Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 <
    c29ff288a2d97a6f4640a498a367cf0eb91312eb
  - >-
    Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 <
    1cba4dcd795daf6d257122779fb6a349edf03914
  - >-
    Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 <
    8acffeef5ef720c35e513e322ab08e32683f32f2
  - Linux 5.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:22:14.418696Z'
published: '2026-04-24'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:18.788Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31590'
references:
  - url: 'https://git.kernel.org/stable/c/6a8e3c82122737529b25ef2a048fbcc569d8c055'
  - url: 'https://git.kernel.org/stable/c/a703933bcfa5cc76ca10e2048464600e74136099'
  - url: 'https://git.kernel.org/stable/c/abcd43ff579abd0a654bb4636086e78819dd5f4c'
  - url: 'https://git.kernel.org/stable/c/b670833749ffd8681361db2bb047c6f2e3075f3a'
  - url: 'https://git.kernel.org/stable/c/ab423e5892826202a660b5ac85d1125b0e8301a5'
  - url: 'https://git.kernel.org/stable/c/28cc13ca20431b127d42d84ba10898d03e2c8267'
  - url: 'https://git.kernel.org/stable/c/c29ff288a2d97a6f4640a498a367cf0eb91312eb'
  - url: 'https://git.kernel.org/stable/c/1cba4dcd795daf6d257122779fb6a349edf03914'
  - url: 'https://git.kernel.org/stable/c/8acffeef5ef720c35e513e322ab08e32683f32f2'
tags:
  - cve.org
epss: 0.00125
epssPercentile: 0.02236
ingestedAt: '2026-11-06T15:54:04.058Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION

Drop the WARN in sev_pin_memory() on npages overflowing an int, as the
WARN is comically trivially to trigger from userspace, e.g. by doing:

  struct kvm_enc_region range = {
          .addr = 0,
          .size = -1ul,
  };

  __vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, &range);

Note, the checks in sev_mem_enc_register_region() that presumably exist to
verify the incoming address+size are completely worthless, as both "addr"
and "size" are u64s and SEV is 64-bit only, i.e. they _can't_ be greater
than ULONG_MAX.  That wart will be cleaned up in the near future.

	if (range->addr > ULONG_MAX || range->size > ULONG_MAX)
		return -EINVAL;

Opportunistically add a comment to explain why the code calculates the
number of pages the "hard" way, e.g. instead of just shifting @ulen.

## Affected

- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < 6a8e3c82122737529b25ef2a048fbcc569d8c055`
- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < a703933bcfa5cc76ca10e2048464600e74136099`
- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < abcd43ff579abd0a654bb4636086e78819dd5f4c`
- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < b670833749ffd8681361db2bb047c6f2e3075f3a`
- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < ab423e5892826202a660b5ac85d1125b0e8301a5`
- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < 28cc13ca20431b127d42d84ba10898d03e2c8267`
- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < c29ff288a2d97a6f4640a498a367cf0eb91312eb`
- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < 1cba4dcd795daf6d257122779fb6a349edf03914`
- `Linux >= 78824fabc72e5e37d51e6e567fde70a4fc41a6d7 < 8acffeef5ef720c35e513e322ab08e32683f32f2`
- `Linux 5.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.