CVE-2009-3638: Integer overflow in the kvm_dev_ioctl_get_supported_cpuid function in arch/x86/kvm/x86.c in the KVM subsyst...

Security readout for executives and security teams

CVE-2009-3638 is an old Linux kernel KVM flaw where a local user could trigger an integer overflow in supported-CPUID handling. The public record says the impact is unspecified, so urgency depends on whether legacy KVM hosts still run affected kernels. Exposure is most likely on legacy Linux virtualization hosts using KVM with kernels older than 2.6.31.4. The source bundle does not enumerate exact affected distro package versions. Treat this as a legacy virtualization hygiene issue. It is not documented as remotely exploitable or actively exploited, but old KVM hosts with local users should be patched or retired. Mitigation focus: Upgrade affected Linux kernels to a fixed vendor-supported release.; Prioritize vendor advisories for Ubuntu, Mandriva, Fedora, and Red Hat-derived environments.; Retire or isolate unsupported legacy KVM hosts until kernel updates are confirmed..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.