CVE-2026-63940
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A vulnerability in the Linux kernel's KVM SEV implementation has been fixed, where Port I/O requests with a length of '0' were not properly ignored. This could cause an underflow when configuring the scratch area, potentially leading to incorrect behavior or system crashes.
Risk Assessment
The risk involves potential disruption of virtual machines using SEV (Secure Encrypted Virtualization) by sending a specially crafted Port I/O request with zero length, which may lead to unpredictable behavior or information disclosure.
Recommendation
It is recommended to immediately update the Linux kernel to a version containing the fix (the commit with the solution). Monitor the availability of the patch for your distribution and apply it first on production systems with KVM/SEV virtualization.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.