CVE-2026-63940
criticalIn the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of l…
Vendor / product: Linux — linux kernel
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.
CVSS
9.3
9.3 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)
Timeline (UTC)
Published: 2026-07-19 16:17
Modified: 2026-10-28 18:31
NVD status: Analyzed
Last synced 14 hours ago
Verified against the source API 2026-10-28 18:48 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
linux / linux_kernel ≥5.11 <6.6.160, ≥6.7 <6.12.95, ≥6.13 <6.18.35, ≥6.19 <7.0.12, 7.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://git.kernel.org/stable/c/2254972d4d69e279ba4e87bf0968eb08ad0d3c92
Patch / mitigation: https://git.kernel.org/stable/c/3988bd2723de407ae90fa7a6f6029b4e60238c58
Patch / mitigation: https://git.kernel.org/stable/c/3b6035bc6bff20e89752ce4358bc4c9a9d5883f2
Patch / mitigation: https://git.kernel.org/stable/c/bbd3a27e4f99fdcad82d12d79c04a95dff1ff70b
Patch / mitigation: https://git.kernel.org/stable/c/c30cde934c7813b4e3069765dac64ce3d31e34f2
References
- https://git.kernel.org/stable/c/2254972d4d69e279ba4e87bf0968eb08ad0d3c92 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/3988bd2723de407ae90fa7a6f6029b4e60238c58 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/3b6035bc6bff20e89752ce4358bc4c9a9d5883f2 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/bbd3a27e4f99fdcad82d12d79c04a95dff1ff70b 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/c30cde934c7813b4e3069765dac64ce3d31e34f2 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Data sources
NVD CVE API 2.0 — fetched 2026-10-28 18:48 UTC · record ↗