CVE-2026-31564

Description

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix base address calculation in kvm_eiointc_regs_access() In function kvm_eiointc_regs_access(), the register base address is caculated from array base address plus offset, the offset is absolute value from the base address. The data type of array base address is u64, it should be converted into the "void *" type and then plus the offset.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* - VULNERABLE

Linux Kernel (LoongArch architecture, versions prior to fix commits 6bcfb7f and c4f0a94)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * PoC Concept for CVE-2026-31564
 * This simulates the logic error in address calculation.
 * Vulnerable kernel code performs arithmetic on u64 before casting.
 */

#include <stdio.h>
#include <stdint.h>

// Simulate the vulnerable logic
void vulnerable_access(uint64_t base, uint64_t offset) {
    // Vulnerable: u64 arithmetic addition (context dependent)
    // If 'offset' is treated as byte offset, this might be fine,
    // but if the logic expects pointer alignment or specific casting, it fails.
    uint64_t bad_addr_val = base + offset;
    void *bad_ptr = (void *)bad_addr_val;
    printf("[VULN] Calculated Address: %p\n", bad_ptr);
}

// Simulate the fixed logic
void fixed_access(uint64_t base, uint64_t offset) {
    // Fix: Cast to void* first, then add offset (pointer arithmetic)
    void *good_ptr = (void *)base + offset;
    printf("[FIX] Calculated Address: %p\n", good_ptr);
}

int main() {
    uint64_t base = 0x80000000;
    uint64_t offset = 0x100;
    
    vulnerable_access(base, offset);
    fixed_access(base, offset);
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-31564
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-31564
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-31564/
[4] VulDB https://vuldb.com/cve/CVE-2026-31564
[5] https://git.kernel.org/stable/c/6bcfb7f46d667b04bd1a1169ccedf5fb699c60df
[6] https://git.kernel.org/stable/c/c4f0a9481cf0dd7c71a07484bc98f2570fdb3a82

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-31564", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-04-24T15:16:30.850", "lastModified": "2026-04-27T20:31:10.233", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Fix base address calculation in kvm_eiointc_regs_access()\n\nIn function kvm_eiointc_regs_access(), the register base address is\ncaculated from array base address plus offset, the offset is absolute\nvalue from the base address. The data type of array base address is\nu64, it should be converted into the \"void *\" type and then plus the\noffset."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.1", "versionEndExcluding": "6.19.11", "matchCriteriaId": "5054C854-C253-4020-BD2E-2BDA121E424C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*", "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6bcfb7f46d667b04bd1a1169ccedf5fb699c60df", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/c4f0a9481cf0dd7c71a07484bc98f2570fdb3a82", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}