CVE-2026-31588

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) component. This vulnerability, a use-after-free, occurs when KVM processes Memory-mapped I/O (MMIO) writes that span across different memory pages, and an internal temporary variable is used. A malicious guest operating system or a local user could exploit this by performing specific MMIO write operations, leading to KVM attempting to access memory that has already been released. This can result in memory corruption, which might allow for information disclosure or the execution of unauthorized code.

KVM x86 MMIO fastpath could mis-handle multi-fragment small writes and corrupt guest state references. Red Hat advises hosts running KVM workloads to pick up the fix via virtualization-enabled kernel streams. No discrete customer mitigation replaces patching.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.