Linux Kernel KVM hypervisor Vulnerability Rated 8.8 CVSS

Status: UPDATED  |  Advisory ID: CVE-2026-89907

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Validate MSI data before routing it to EIOINTC

pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as

the irq number. The MSI data comes from userspace, that either via a

KVM_IRQ_ROUTING_MSI entry set with KVM_SET_GSI_ROUTING (used by irqfd

and KVM_IRQ_LINE) or directly via KVM_SIGNAL_MSI, and is never checked

against EIOINTC_IRQS.

eiointc_set_irq() uses the value with __set_bit()/__clear_bit() on the

256-bit isr bitmap, eiointc_update_irq() then indexes sw_coremap[] and

the per-cpu coreisr/sw_coreisr bitmaps with it. Therefore a data value

>= 256 reads and writes memory past the end of those arrays, i.e. any

process holding a VM fd can corrupt kernel memory beyond the allocation

of loongarch_eiointc.

Reject MSI data that doesn't fit in the EIOINTC irq space. The DMSINTC

path is unaffected as it decodes the vector from the address and masks

it. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References