KVM: x86: Use scratch field in MMIO fragment to hold small write values
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use scratch field in MMIO fragment to hold small write values When exiting to userspace to service an emulated MMIO write, copy the to-be-written value to a scratch field in the MMIO fragment if the size of the data payload is 8 bytes or less, i.e. can fit in a single chunk, instead of pointing the fragment directly at the source value. This fixes a class of use-after-free bugs that occur when the emulator initiates a write using an on-stack, local variable as the source, the write splits a page boundary, *and* both pages are MMIO pages. Because KVM's ABI only allows for physically contiguous MMIO requests, accesses that split MMIO pages are separated into two fragments, and are sent to userspace one at a time. When KVM attempts to complete userspace MMIO in response to KVM_RUN after the first fragment, KVM will detect the second fragment and generate a second userspace exit, and reference the on-stack variable. The issue is most visible if the second KVM_RUN is performed by a separate task, in which case the stack of the initiating task can show up as truly freed data. ================================================================== BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420 Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984 CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3 Hardware name: QEMU Standard PC (i440F
CVE-2026-31588
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-31588
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "f78146b0f9230765c6315b2e14f56112513389ad",
"lessThan": "019d0bd32b9a4646ba35d904907452039e2db700",
"versionType": "git"
},
{
"status": "affected",
"version": "f78146b0f9230765c6315b2e14f56112513389ad",
"lessThan": "4569c66dd9e94a22cd0796b6514a8b25ffff16a1",
"versionType": "git"
},
{
"status": "affected",
"version": "f78146b0f9230765c6315b2e14f56112513389ad",
"lessThan": "52570e73d48f1c73836d37e594667117b4c2a5a8",
"versionType": "git"
},
{
"status": "affected",
"version": "f78146b0f9230765c6315b2e14f56112513389ad",
"lessThan": "dc6a6c3db3a4eca7e747cfc46e22c08d016c68f7",
"versionType": "git"
},
{
"status": "affected",
"version": "f78146b0f9230765c6315b2e14f56112513389ad",
"lessThan": "b5a02d37eb0739f462fa12df449ab9b3480c783b",
"versionType": "git"
},
{
"status": "affected",
"version": "f78146b0f9230765c6315b2e14f56112513389ad",
"lessThan": "22d2ff69d487a32a8b88f9c970120fc2daa08a77",
"versionType": "git"
},
{
"status": "affected",
"version": "f78146b0f9230765c6315b2e14f56112513389ad",
"lessThan": "2b83d91e9ae92fe1258d7040a32430bbb3bb7d6e",
"versionType": "git"
},
{
"status": "affected",
"version": "f78146b0f9230765c6315b2e14f56112513389ad",
"lessThan": "3a7b6d75c8f85b09dea893f64a85a356bcf6c3fe",
"versionType": "git"
},
{
"status": "affected",
"version": "f78146b0f9230765c6315b2e14f56112513389ad",
"lessThan": "0b16e69d17d8c35c5c9d5918bf596c75a44655d3",
"versionType": "git"
}
],
"programFiles": [
"arch/x86/kvm/x86.c",
"include/linux/kvm_host.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/x86/kvm/x86.c",
"include/linux/kvm_host.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-31588
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #39926 · Revision 1
- Added to Heist Feed
- Publisher date