CVE-2026-63940

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63940", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.022Z", "datePublished": "2026-07-19T14:55:36.408Z", "dateUpdated": "2026-10-30T12:27:21.359Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:27:21.359Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Ignore Port I/O requests of length '0'\n\nExplicitly ignore Port I/O requests of length '0' (or count '0'), so that\nsetting up the software scratch area (and other code) doesn't have to\nworry about underflowing the length, and to allow for WARNing on trying\nto configure the scratch area with len==0."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.3, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached when a SEV-ES/SEV-SNP guest triggers a #VMGEXIT with a crafted GHCB Port I/O request; exploitation requires executing code inside a guest VM on the host, not remote network delivery.\nAC:L - A guest can reliably set GHCB exit_info_1 size to 0 (or count to 0) and issue string Port I/O via VMGEXIT without races or special host state; success does not depend on conditions outside attacker control.\nPR:N - The attacker needs no privileges on the host kernel\u2014only code execution inside an SEV-ES guest VM, which is the normal capability of a cloud confidential-VM tenant with no elevated host access.\nUI:N - Exploitation is fully attacker-driven from guest code via VMGEXIT; no host administrator or other user action is required.\nS:C - The vulnerable component is the host KVM hypervisor, but exploitation is initiated from a guest VM and impacts host kernel integrity/availability, crossing the guest/host security boundary.\nC:H - Allowing zero-length scratch setup sets ghcb_sa_len to 0, enabling unsigned length underflow in scratch-area size arithmetic; combined with ZERO_SIZE_PTR from kvzalloc(0), this is a memory-safety defect class that can yield out-of-bounds read primitives.\nI:H - Zero-length scratch configuration corrupts length tracking used by subsequent GHCB scratch handling, creating integer-underflow conditions that can lead to out-of-bounds writes; the divide-by-zero path also demonstrates uncontrolled host kernel failure from guest input.\nA:H - A malicious guest can reliably panic the host kernel via divide-by-zero in kvm_sev_es_string_io() when size is 0 and count is non-zero, causing complete loss of hypervisor availability for all co-hosted workloads."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/sev.c"], "versions": [{"version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "c8aa0a79ab0b23cde4c46ccff78e63be35733e04", "status": "affected", "versionType": "git"}, {"version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "bbd3a27e4f99fdcad82d12d79c04a95dff1ff70b", "status": "affected", "versionType": "git"}, {"version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "3b6035bc6bff20e89752ce4358bc4c9a9d5883f2", "status": "affected", "versionType": "git"}, {"version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "2254972d4d69e279ba4e87bf0968eb08ad0d3c92", "status": "affected", "versionType": "git"}, {"version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "c30cde934c7813b4e3069765dac64ce3d31e34f2", "status": "affected", "versionType": "git"}, {"version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "3988bd2723de407ae90fa7a6f6029b4e60238c58", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/sev.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c8aa0a79ab0b23cde4c46ccff78e63be35733e04"}, {"url": "https://git.kernel.org/stable/c/bbd3a27e4f99fdcad82d12d79c04a95dff1ff70b"}, {"url": "https://git.kernel.org/stable/c/3b6035bc6bff20e89752ce4358bc4c9a9d5883f2"}, {"url": "https://git.kernel.org/stable/c/2254972d4d69e279ba4e87bf0968eb08ad0d3c92"}, {"url": "https://git.kernel.org/stable/c/c30cde934c7813b4e3069765dac64ce3d31e34f2"}, {"url": "https://git.kernel.org/stable/c/3988bd2723de407ae90fa7a6f6029b4e60238c58"}], "title": "KVM: SEV: Ignore Port I/O requests of length '0'", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63940", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:33:50.957635Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:17:57.930Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63940", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:33:50.957635Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:33:51.578Z"}}], "cna": {"title": "KVM: SEV: Ignore Port I/O requests of length '0'", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached when a SEV-ES/SEV-SNP guest triggers a #VMGEXIT with a crafted GHCB Port I/O request; exploitation requires executing code inside a guest VM on the host, not remote network delivery.\nAC:L - A guest can reliably set GHCB exit_info_1 size to 0 (or count to 0) and issue string Port I/O via VMGEXIT without races or special host state; success does not depend on conditions outside attacker control.\nPR:N - The attacker needs no privileges on the host kernel\u2014only code execution inside an SEV-ES guest VM, which is the normal capability of a cloud confidential-VM tenant with no elevated host access.\nUI:N - Exploitation is fully attacker-driven from guest code via VMGEXIT; no host administrator or other user action is required.\nS:C - The vulnerable component is the host KVM hypervisor, but exploitation is initiated from a guest VM and impacts host kernel integrity/availability, crossing the guest/host security boundary.\nC:H - Allowing zero-length scratch setup sets ghcb_sa_len to 0, enabling unsigned length underflow in scratch-area size arithmetic; combined with ZERO_SIZE_PTR from kvzalloc(0), this is a memory-safety defect class that can yield out-of-bounds read primitives.\nI:H - Zero-length scratch configuration corrupts length tracking used by subsequent GHCB scratch handling, creating integer-underflow conditions that can lead to out-of-bounds writes; the divide-by-zero path also demonstrates uncontrolled host kernel failure from guest input.\nA:H - A malicious guest can reliably panic the host kernel via divide-by-zero in kvm_sev_es_string_io() when size is 0 and count is non-zero, causing complete loss of hypervisor availability for all co-hosted workloads."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "bbd3a27e4f99fdcad82d12d79c04a95dff1ff70b", "versionType": "git"}, {"status": "affected", "version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "3b6035bc6bff20e89752ce4358bc4c9a9d5883f2", "versionType": "git"}, {"status": "affected", "version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "2254972d4d69e279ba4e87bf0968eb08ad0d3c92", "versionType": "git"}, {"status": "affected", "version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "c30cde934c7813b4e3069765dac64ce3d31e34f2", "versionType": "git"}, {"status": "affected", "version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "3988bd2723de407ae90fa7a6f6029b4e60238c58", "versionType": "git"}], "programFiles": ["arch/x86/kvm/svm/sev.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"status": "unaffected", "version": "0", "lessThan": "5.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.95", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.35", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.12", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/x86/kvm/svm/sev.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/bbd3a27e4f99fdcad82d12d79c04a95dff1ff70b"}, {"url": "https://git.kernel.org/stable/c/3b6035bc6bff20e89752ce4358bc4c9a9d5883f2"}, {"url": "https://git.kernel.org/stable/c/2254972d4d69e279ba4e87bf0968eb08ad0d3c92"}, {"url": "https://git.kernel.org/stable/c/c30cde934c7813b4e3069765dac64ce3d31e34f2"}, {"url": "https://git.kernel.org/stable/c/3988bd2723de407ae90fa7a6f6029b4e60238c58"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Ignore Port I/O requests of length '0'\n\nExplicitly ignore Port I/O requests of length '0' (or count '0'), so that\nsetting up the software scratch area (and other code) doesn't have to\nworry about underflowing the length, and to allow for WARNing on trying\nto configure the scratch area with len==0."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.95", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.35", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.12", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "5.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:42:44.819Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63940", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:42:44.819Z", "dateReserved": "2026-07-19T07:54:57.022Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T14:55:36.408Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/kvm/svm/sev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c8aa0a79ab0b23cde4c46ccff78e63be35733e04", "status": "affected", "version": "291bd20d5d88814a73d43b55b9428feab2f28094", "versionType": "git"}, {"lessThan": "bbd3a27e4f99fdcad82d12d79c04a95dff1ff70b", "status": "affected", "version": "291bd20d5d88814a73d43b55b9428feab2f28094", "versionType": "git"}, {"lessThan": "3b6035bc6bff20e89752ce4358bc4c9a9d5883f2", "status": "affected", "version": "291bd20d5d88814a73d43b55b9428feab2f28094", "versionType": "git"}, {"lessThan": "2254972d4d69e279ba4e87bf0968eb08ad0d3c92", "status": "affected", "version": "291bd20d5d88814a73d43b55b9428feab2f28094", "versionType": "git"}, {"lessThan": "c30cde934c7813b4e3069765dac64ce3d31e34f2", "status": "affected", "version": "291bd20d5d88814a73d43b55b9428feab2f28094", "versionType": "git"}, {"lessThan": "3988bd2723de407ae90fa7a6f6029b4e60238c58", "status": "affected", "version": "291bd20d5d88814a73d43b55b9428feab2f28094", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/kvm/svm/sev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.95", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "406D971A-C4AE-4CA6-811C-3C4B87812199", "versionEndExcluding": "6.6.160", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E206B86-E0E3-4394-A93F-39F2D50A8AA8", "versionEndExcluding": "6.12.95", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382", "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Ignore Port I/O requests of length '0'\n\nExplicitly ignore Port I/O requests of length '0' (or count '0'), so that\nsetting up the software scratch area (and other code) doesn't have to\nworry about underflowing the length, and to allow for WARNing on trying\nto configure the scratch area with len==0."}], "id": "CVE-2026-63940", "lastModified": "2026-10-30T13:19:22.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63940", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:33:50.957635Z", "version": "2.0.3"}}]}, "published": "2026-07-19T16:17:12.540", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2254972d4d69e279ba4e87bf0968eb08ad0d3c92"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3988bd2723de407ae90fa7a6f6029b4e60238c58"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b6035bc6bff20e89752ce4358bc4c9a9d5883f2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bbd3a27e4f99fdcad82d12d79c04a95dff1ff70b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c30cde934c7813b4e3069765dac64ce3d31e34f2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c8aa0a79ab0b23cde4c46ccff78e63be35733e04"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-191"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-190"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: KVM: SEV: Ignore Port I/O requests of length '0'", "id": "2502383", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502383"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-130", "details": ["A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) Secure Encrypted Virtualization (SEV) module. This vulnerability occurs because the system does not properly handle Port I/O requests with a length of zero. An attacker, potentially from a guest virtual machine, could exploit this to cause a system crash or instability, leading to a denial of service (DoS)."], "name": "CVE-2026-63940", "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63940\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63940\nhttps://lore.kernel.org/linux-cve-announce/2026071952-CVE-2026-63940-904d@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[291bd20d5d88814a73d43b55b9428feab2f28094,3b6035bc6bff20e89752ce4358bc4c9a9d5883f2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[291bd20d5d88814a73d43b55b9428feab2f28094,2254972d4d69e279ba4e87bf0968eb08ad0d3c92)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[291bd20d5d88814a73d43b55b9428feab2f28094,c30cde934c7813b4e3069765dac64ce3d31e34f2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[291bd20d5d88814a73d43b55b9428feab2f28094,3988bd2723de407ae90fa7a6f6029b4e60238c58)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.95,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T05:30:16.523879+00:00", "updated": "2026-10-28T20:30:07.275895+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-130", "CWE-190", "CWE-191"]}