Executive brief
The Linux kernel's LoongArch KVM virtualization component fails to validate Message Signaled Interrupt (MSI) data supplied by userspace before using it to index kernel data structures. An attacker with access to a KVM virtual machine can supply out-of-bounds MSI data values to corrupt kernel memory, potentially leading to privilege escalation or system crash.
Technical details
The vulnerability is an out-of-bounds memory access in the LoongArch KVM interrupt handling code. The pch_msi_set_irq() function passes MSI data directly from userspace (via KVM_IRQ_ROUTING_MSI, KVM_SET_GSI_ROUTING, or KVM_SIGNAL_MSI) to eiointc_set_irq() without validating it against EIOINTC_IRQS. The function uses this unchecked value as an index in __set_bit()/__clear_bit() operations on a 256-bit bitmap and in subsequent array indexing in eiointc_update_irq(). An MSI data value >= 256 causes reads and writes past the end of the isr bitmap and coreisr/sw_coreisr arrays, corrupting kernel memory beyond the loongarch_eiointc allocation. Any process holding a VM file descriptor can exploit this. The fix adds input validation to reject MSI data >= EIOINTC_IRQS before processing.
Affected products
- Linux Linux kernel All versions with LoongArch KVM support (introduced in commit 1928254c5ccb); patch available in linux-5.19+ and stable branches
Timeline
- 2026-09-16: disclosed: CVE-2026-89907 published
- 2026-09-04: patched: Patch committed upstream (501514d6ebd2111c353a1296f25dbe22fbd64657)
- 2026-09-11: patched: Patch backported to stable kernels (83715a40a2d30d23719e0b25380ba82ff905195b)