Security readout for executives and security teams
Plain-English summary
A flaw in Linux KVM on LoongArch systems can read outside an internal CPU-mapping array when the EIOINTC core map is empty. A locally authenticated user may trigger service disruption and limited information exposure. The supplied CVSS score is 7.3 (high), but exposure appears limited to systems using the affected LoongArch virtualization path.
Executive priority
Treat as a high-priority infrastructure patch for exposed LoongArch KVM hosts, especially multi-user or multi-tenant systems. Broad enterprise emergency action is not supported without evidence that this architecture and feature are deployed. First establish inventory, then patch affected hosts through supported distribution channels.
Technical view
eiointc_update_sw_coremap() can derive CPU ID -1 from an empty EIOINTC core map and use it in kvm_arch::phyid_map::phys_map[], causing out-of-bounds access. The correction treats the empty-map case as CPU ID 0, similarly to CPU IDs at or above four. The CVSS vector indicates local, low-complexity, low-privilege exploitation without user interaction.
Likely exposure
Prioritize LoongArch hosts running KVM where guests or local users can reach EIOINTC handling. Other architectures and systems not using this virtualization path are not shown as affected. The supplied version data identifies Linux releases beginning with 6.13 but is ambiguous about exact fixed-version boundaries; confirm against distribution and kernel stable advisories.
Exploitation context
The supplied evidence does not establish active exploitation, and this CVE is not identified as KEV. Exploitation requires local low-privilege access according to the CVSS vector. Expected consequences are primarily availability loss, with limited confidentiality impact and no stated integrity impact. No public exploit evidence is included.
Researcher notes
No CWE is assigned in the supplied record. The defect is an out-of-bounds access caused by a negative CPU identifier when EIOINTC's core map is empty. Three kernel stable commits are cited as corrections. The bundle does not provide crash traces, exploit demonstrations, precise affected-range semantics, or evidence of remote reachability.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable cited stable fix.
- Confirm fixed package versions with your Linux distribution or kernel vendor.
- Restrict untrusted local access to affected LoongArch KVM hosts until updated.
- Reduce use of affected KVM and EIOINTC functionality where operationally feasible.
Validation and detection
- Inventory LoongArch systems, kernel versions, KVM usage, and EIOINTC exposure.
- Compare deployed kernel builds with vendor advisories and the cited stable commits.
- Verify the installed kernel package includes the empty-coremap bounds correction.
- Review host logs for KVM faults, crashes, or unusual availability events.
- Reboot into the corrected kernel and confirm the active running version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31569 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H24.7LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/126053d0a685bf1f2e98db8966386f38b2336338CVE reference, Linux
- https://git.kernel.org/stable/c/2a0cbcd28ecf6e0b88fa498bebb94bd1be61a7c3CVE reference, Linux
- https://git.kernel.org/stable/c/b97bd69eb0f67b5f961b304d28e9ba45e202d841CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.