Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.
CVSS Score
CRITICAL
References
- https://git.kernel.org/stable/c/2254972d4d69e279ba4e87bf0968eb08ad0d3c92
- https://git.kernel.org/stable/c/3988bd2723de407ae90fa7a6f6029b4e60238c58
- https://git.kernel.org/stable/c/3b6035bc6bff20e89752ce4358bc4c9a9d5883f2
- https://git.kernel.org/stable/c/c30cde934c7813b4e3069765dac64ce3d31e34f2
FAQ
What is CVE-2026-63940?
CVE-2026-63940 is a vulnerability with a CVSS score of 9.3 (CRITICAL). In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting...
How severe is CVE-2026-63940?
CVE-2026-63940 has been rated CRITICAL with a CVSS base score of 9.3/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-63940?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.