What’s Vulnerable › Vulnerabilities

CVE-2026-63940: KVM: SEV: Ignore Port I/O requests of length '0'

• Severity: critical (CVSS 9.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-19 · updated 2026-10-30
• Weakness: CWE-191

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.

Affected products

• Linux kernel: from 5.11 before 6.6.160; from 6.7 before 6.12.95; from 6.13 before 6.18.35; from 6.19 before 7.0.12; 7.1-rc1, 7.1-rc2, 7.1-rc3, 7.1-rc4, 7.1-rc5 — fixed in 6.6.160, 6.12.95, 6.18.35, 7.0.12
• Linux: 5.11 — fixed in 7.1

How to fix

Upgrade to a fixed version: Linux kernel 6.6.160, 6.12.95, 6.18.35, 7.0.12; Linux 7.1. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/2254972d4d69e279ba4e87bf0968eb08ad0d3c92
• https://git.kernel.org/stable/c/3988bd2723de407ae90fa7a6f6029b4e60238c58
• https://git.kernel.org/stable/c/3b6035bc6bff20e89752ce4358bc4c9a9d5883f2
• https://git.kernel.org/stable/c/bbd3a27e4f99fdcad82d12d79c04a95dff1ff70b
• https://git.kernel.org/stable/c/c30cde934c7813b4e3069765dac64ce3d31e34f2
• https://git.kernel.org/stable/c/c8aa0a79ab0b23cde4c46ccff78e63be35733e04

Get alerted when CVE-2026-63940 or the next vulnerability affects your stack