CVE-2026-31569
Published: 24 April 2026
Summary
CVE-2026-31569 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and patching of the out-of-bounds access flaw in LoongArch KVM's eiointc_update_sw_coremap function.
Vulnerability scanning detects the presence of CVE-2026-31569 in LoongArch KVM kernel deployments to prioritize remediation.
Kernel memory protection mechanisms mitigate unauthorized out-of-bounds access to kvm_arch::phyid_map::phys_map array.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB read in LoongArch KVM leads to host kernel crash (DoS via exploitation) or limited memory disclosure from guest context, directly enabling T1499.004 (system exploitation for DoS), T1611 (VM escape to host), and T1068 (resulting privilege escalation or impact beyond guest scope).
NVD Description
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Handle the case that EIOINTC's coremap is empty EIOINTC's coremap in eiointc_update_sw_coremap() can be empty, currently we get a cpuid with -1 in this case, but we actually…
more
need 0 because it's similar as the case that cpuid >= 4. This fix an out-of-bounds access to kvm_arch::phyid_map::phys_map[].
Deeper analysisAI
CVE-2026-31569 is a vulnerability in the Linux kernel's LoongArch KVM implementation, specifically affecting the handling of EIOINTC's coremap in the eiointc_update_sw_coremap() function. When the coremap is empty, the code incorrectly returns a cpuid of -1 instead of 0, leading to an out-of-bounds read access in kvm_arch::phyid_map::phys_map[]. This issue, classified under CWE-125, has a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H) and impacts systems running the vulnerable Linux kernel on LoongArch architectures with KVM enabled.
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Successful exploitation changes the scope to high (S:C), allowing limited confidentiality impact alongside high availability disruption, such as kernel crashes or denial of service via the out-of-bounds access.
Mitigation involves applying the relevant Linux kernel patches, available in stable repository commits such as 126053d0a685bf1f2e98db8966386f38b2336338, 2a0cbcd28ecf6e0b88fa498bebb94bd1be61a7c3, and b97bd69eb0f67b5f961b304d28e9ba45e202d841 on git.kernel.org. Security practitioners should update affected LoongArch KVM deployments promptly to address the improper coremap handling.
Details
- CWE(s)