{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63940", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.022Z", "datePublished": "2026-07-19T14:55:36.408Z", "dateUpdated": "2026-07-20T13:41:42.039Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-20T13:41:42.039Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Ignore Port I/O requests of length '0'\n\nExplicitly ignore Port I/O requests of length '0' (or count '0'), so that\nsetting up the software scratch area (and other code) doesn't have to\nworry about underflowing the length, and to allow for WARNing on trying\nto configure the scratch area with len==0."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.3, "baseSeverity": "CRITICAL"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/sev.c"], "versions": [{"version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "3b6035bc6bff20e89752ce4358bc4c9a9d5883f2", "status": "affected", "versionType": "git"}, {"version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "2254972d4d69e279ba4e87bf0968eb08ad0d3c92", "status": "affected", "versionType": "git"}, {"version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "c30cde934c7813b4e3069765dac64ce3d31e34f2", "status": "affected", "versionType": "git"}, {"version": "291bd20d5d88814a73d43b55b9428feab2f28094", "lessThan": "3988bd2723de407ae90fa7a6f6029b4e60238c58", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/sev.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3b6035bc6bff20e89752ce4358bc4c9a9d5883f2"}, {"url": "https://git.kernel.org/stable/c/2254972d4d69e279ba4e87bf0968eb08ad0d3c92"}, {"url": "https://git.kernel.org/stable/c/c30cde934c7813b4e3069765dac64ce3d31e34f2"}, {"url": "https://git.kernel.org/stable/c/3988bd2723de407ae90fa7a6f6029b4e60238c58"}], "title": "KVM: SEV: Ignore Port I/O requests of length '0'", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{}

{"bugzilla": {"description": "kernel: KVM: SEV: Ignore Port I/O requests of length '0'", "id": "2502383", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502383"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-130", "details": ["A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) Secure Encrypted Virtualization (SEV) module. This vulnerability occurs because the system does not properly handle Port I/O requests with a length of zero. An attacker, potentially from a guest virtual machine, could exploit this to cause a system crash or instability, leading to a denial of service (DoS)."], "name": "CVE-2026-63940", "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63940\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63940\nhttps://lore.kernel.org/linux-cve-announce/2026071952-CVE-2026-63940-904d@gregkh/T"], "threat_severity": "Moderate"}