In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or     count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about     underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.
    (CVE-2026-63940)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
333954	Photon OS 5.0: Linux PHSA-2026-5.0-92-0916	Nessus	PhotonOS Local Security Checks	Local	high
327950	Linux Distros Unpatched Vulnerability : CVE-2026-63940	Nessus	Misc.	Local	critical
326038	Photon OS 5.0: Linux PHSA-2026-5.0-0916	Nessus	PhotonOS Local Security Checks	Local	high
322087	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-63940

critical

Tenable Plugins

high

high

critical

high

high