What’s Vulnerable › Vulnerabilities

CVE-2026-31569: LoongArch: KVM: Handle the case that EIOINTC's coremap is empty

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-24 · updated 2026-06-17
• Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Handle the case that EIOINTC's coremap is empty EIOINTC's coremap in eiointc_update_sw_coremap() can be empty, currently we get a cpuid with -1 in this case, but we actually need 0 because it's similar as the case that cpuid >= 4. This fix an out-of-bounds access to kvm_arch::phyid_map::phys_map[].

Affected products

• Linux kernel: from 6.13.1 before 6.18.21; from 6.19 before 6.19.11; 6.13, 7.0-rc1, 7.0-rc2, 7.0-rc3, 7.0-rc4, 7.0-rc5 (+2) — fixed in 6.18.21, 6.19.11

How to fix

Upgrade to a fixed version: Linux kernel 6.18.21, 6.19.11. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/126053d0a685bf1f2e98db8966386f38b2336338
• https://git.kernel.org/stable/c/2a0cbcd28ecf6e0b88fa498bebb94bd1be61a7c3
• https://git.kernel.org/stable/c/b97bd69eb0f67b5f961b304d28e9ba45e202d841

Get alerted when CVE-2026-31569 or the next vulnerability affects your stack