Executive brief
A memory allocation vulnerability in the Linux kernel's RISC-V KVM (virtualization) implementation can cause an out-of-bounds memory access in the performance monitoring unit (PMU) handler. An attacker running a nested guest virtual machine could trigger this flaw to read or write memory beyond allocated buffers, potentially leading to privilege escalation or denial of service.
Technical details
The vulnerability exists in the KVM RISC-V PMU event info handler (kvm_riscv_vcpu_pmu_event_info). The root cause is an integer overflow in the calculation of a guest-controlled array size: num_events * sizeof(*einfo) is stored in a 32-bit integer, which truncates on 64-bit RISC-V systems. For example, num_events = 0x10000001 results in 0x100000010 truncating to 16 bytes, causing KVM to allocate a small buffer but loop over the original (large) num_events value. This results in out-of-bounds reads and writes detected by KASAN. The attack requires the ability to run a nested guest VM that can issue malicious SBI (Supervisor Binary Interface) PMU calls. The fix involves using size_t for size calculations, detecting multiplication overflow, using kvcalloc() for allocation, and proper memory accounting.
Affected products
- Linux Linux kernel RISC-V KVM implementations prior to fix
Timeline
- 2026-09-11: disclosed