The vulnerability arises in the LoongArch KVM implementation when the EIOINTC controller’s coremap is empty, causing eiointc_update_sw_coremap() to retrieve a cpuid of –1 instead of 0. This leads to an out‑of-bounds read into the kvm_arch::phyid_map::phys_map array, potentially corrupting kernel memory and compromising integrity. The flaw is a classic CWE‑125 out‑of‑bounds read that could be leveraged for privilege escalation within the kernel space.

Affected by CVE‑2026‑31569 are Linux kernel releases 6.13 and all 7.0 release candidates (RC1 through RC7). The issue exists in the Linux:Linux vendor’s kernel for the LoongArch architecture, any system running one of those kernel versions with KVM enabled.

The CVSS score of 7.3 indicates a high severity for local privilege escalation, while the EPSS score of less than 1% suggests the likelihood of exploitation is low at present, and the vulnerability is not listed in CISA KEV. Exploitation would require the attacker to run code or trigger operations in a LoongArch virtualized environment where KVM interacts with an EIOINTC that has an empty coremap; thus, the attack vector is likely local or requires privileged access to a virtual machine. The risk remains significant for environments that use the affected kernels in production, especially those deploying LoongArch KVM instances.