CVE-2026-63940
Received Received - Intake

Port I/O Length Zero Handling in Linux Kernel KVM SEV

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63940
EUVD
EUVD-2026-45713

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of Port I/O requests with a length of zero in the KVM (Kernel-based Virtual Machine) SEV (Secure Encrypted Virtualization) component. The issue is that the kernel does not explicitly ignore these zero-length requests, which could lead to potential underflow issues when setting up the software scratch area or other related code.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM SEV (Secure Encrypted Virtualization) component. Detection requires checking kernel logs for Port I/O requests with length 0 or examining KVM SEV-related errors during virtual machine operations.

Impact Analysis

The impact of this vulnerability is likely limited to systems using KVM with SEV enabled. An attacker with access to a guest VM could potentially exploit this to cause unexpected behavior or crashes in the host system by sending zero-length Port I/O requests, though the exact consequences depend on the system configuration and usage.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue related to KVM and SEV handling of Port I/O requests, which does not involve data privacy, security controls, or protected health information.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. Monitor KVM SEV operations for errors and ensure no virtual machines are running with unpatched kernels.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63940. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart