Use-after-free in Linux kernel KVM x86 emulated MMIO write handling

CVE-2026-31588 is a use-after-free vulnerability in the Linux kernel's KVM x86 subsystem during emulated MMIO write handling. The flaw occurs when KVM exits to userspace to service an emulated MMIO write and retains a pointer to the original source value instead of copying the value for small writes. Under the vulnerable conditions, the emulator initiates a write using an on-stack local variable as the source, the write crosses a page boundary, and both pages are MMIO pages. Because KVM's ABI supports only physically contiguous MMIO requests, such an access is split into two fragments and delivered to userspace one fragment at a time. When KVM later completes the first userspace MMIO operation and detects the second fragment, it can generate a second userspace exit that still references the original on-stack variable, resulting in a stale pointer dereference in complete_emulated_mmio(). The fix changes KVM x86 to copy write values of 8 bytes or less into a scratch field in the MMIO fragment instead of pointing directly to the original source value, and adds sanity checks around the assumptions that larger accesses and reads are not affected by current emulator behavior.