Linux Kernel KVM CVE-2026-72294

The Linux kernel's KVM (Kernel-based Virtual Machine) subsystem provides hardware-assisted virtualization. On the LoongArch architecture - a RISC ISA developed by Loongson Technology and primarily deployed in Chinese market systems - KVM exposes ioctl interfaces to userspace (typically QEMU or similar VMMs) for managing virtual CPUs. The function kvm_vcpu_ioctl_interrupt() accepts IRQ numbers from userspace callers but, prior to this fix, performed no validity check on those values. Passing an out-of-bounds or otherwise invalid IRQ number could trigger undefined behavior in kernel memory structures that track interrupt state for the virtual CPU. The CPE string cpe:2.3:a:linux:linux:* confirms the affected product is the upstream Linux kernel. No CWE was assigned by NVD, but the root cause class maps to CWE-20 (Improper Input Validation) - a failure to sanitize caller-supplied data before use in a privileged kernel context. The vulnerability was introduced at commit f45ad5b8aa9335bc6b30331b739e778f2f730b35 and is fixed in multiple stable branches.