What is CVE-2026-63940?

CVE-2026-63940 is a critical-severity vulnerability in Linux. CVSS score: 9.3/10. Published 2026-07-19.

How severe is CVE-2026-63940?

Critical severity. CVSS v3 base score is 9.3 out of 10.

Vulnerability in Linux

CVE-2026-63940

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.

EPSS: 0.002 (8.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Linux — versions 291bd20d5d88814a73d43b55b9428feab2f28094, 5.11, 0

References

416baaa9-dc9f-4396-8d5f-8c081fb06d67
416baaa9-dc9f-4396-8d5f-8c081fb06d67
416baaa9-dc9f-4396-8d5f-8c081fb06d67
416baaa9-dc9f-4396-8d5f-8c081fb06d67

Frequently asked questions

What is CVE-2026-63940?: CVE-2026-63940 is a critical-severity vulnerability in Linux. CVSS score: 9.3/10. Published 2026-07-19.
How severe is CVE-2026-63940?: Critical severity. CVSS v3 base score is 9.3 out of 10.