In the Linux kernel’s KVM Secure Encrypted Virtualization subsystem, an integer overflow occurs when the number of pages that a memory region will occupy is calculated. The kernel emits a warning if the computed page count exceeds the size of a signed 32‑bit integer. A user with the ability to invoke the KVM_MEMORY_ENCRYPT_REG_REGION ioctl can deliberately trigger this condition by passing a negative size value. The overflow itself does not provide arbitrary code execution, privilege escalation, or direct data disclosure; it merely results in a warning message.

All Linux kernel releases that include the KVM SEV implementation and contain the vulnerable code path are affected. No version range is specified in the CNA data, so any kernel older than the release that introduced the fix for CVE‑2026‑31590 is potentially impacted.

The CVSS base score of 5.5 indicates a moderate impact. The EPSS score of < 1 % suggests a very low probability that the flaw will be actively exploited. The vulnerability is not listed in CISA’s KEV catalog. To exploit the flaw an attacker must have privileged (root or equivalent) access to the host to issue the ioctl; non‑privileged users cannot trigger it. Consequently, the overall risk is moderate but the likelihood of successful exploitation remains low.