Executive brief
The Linux kernel's LoongArch KVM subsystem contains a flaw in interrupt handling where a stack variable is sometimes used without being initialized. This could allow a privileged attacker with KVM access to trigger unexpected kernel behavior, potentially leading to information disclosure or denial of service in virtualized environments.
Technical details
The vulnerability is an uninitialized stack variable issue in the dmsintc_inject_irq() function within arch/loongarch/kvm/intc/dmsintc.c. The vector[] array is declared on the stack and conditionally populated; when the condition is not met, the array elements remain uninitialized and may be used in subsequent operations. The fix ensures all array elements are properly initialized via a ternary operator, replacing conditional assignment with guaranteed assignment. Attack requires local access to a LoongArch KVM hypervisor. Patches are available in the Linux kernel stable tree and were backported by Greg Kroah-Hartman.
Affected products
- Linux Linux Kernel LoongArch KVM (affected versions unspecified in advisory)
Timeline
- 2026-09-16: disclosed
- 2026-08-10: patched