EUVD-2026-76419
GHSA-8mvp-fqvr-fj7j
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Guest-to-host attack is local (AV:L), deterministic (AC:L), requires only guest-level access (PR:L), and compromises host kernel scope (S:C/C:H/I:H/A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM: Fix PMU event info array size overflow
SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo) in a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one entry but loops over the original num_events, causing out-of-bounds reads and writes. A nested guest triggered:
BUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info+0xa4/0x142 Read of size 4 at addr ff600000074d46b0 by task init/1 Call Trace: [<ffffffff8006471c>] kvm_riscv_vcpu_pmu_event_info+0xa4/0x142 [<ffffffff800690c0>] kvm_sbi_ext_pmu_handler+0xca/0x268 [<ffffffff8006779e>] kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6 [<ffffffff8006008c>] kvm_riscv_vcpu_exit+0x48c/0x540 [<ffffffff8005ea0a>] kvm_arch_vcpu_ioctl_run+0x37e/0xc80 Allocated by task 1: __kmalloc_noprof+0x19e/0x4b0 kvm_riscv_vcpu_pmu_event_info+0x72/0x142 kvm_sbi_ext_pmu_handler+0xca/0x268 kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6 kvm_riscv_vcpu_exit+0x48c/0x540 kvm_arch_vcpu_ioctl_run+0x37e/0xc80 The buggy address is located 0 bytes to the right of allocated 16-byte region [ff600000074d46a0, ff600000074d46b0)
Store the shared-memory size in size_t and reject multiplication overflow. Allocate the guest-driven array with GFP_KERNEL_ACCOUNT so it is charged to kmemcg, and use __GFP_NOWARN to suppress allocation failure warnings. Use kvcalloc() to allow vmalloc fallback and an unsigned long loop index to match num_events.
AnalysisAI
Integer overflow in RISC-V KVM's SBI PMU EVENT_GET_INFO handler allows a guest VM to trigger out-of-bounds heap reads and writes on the host kernel, with scope-changed impact (C:H/I:H/A:H). A malicious or compromised guest on a RISC-V host running KVM can supply a crafted num_events value (e.g., 0x10000001 on RV64) that overflows a 32-bit multiplication, causing under-allocation of the event-info array while the subsequent loop iterates over the original large count - resulting in slab-out-of-bounds memory corruption confirmed by KASAN traces. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a RISC-V 64-bit (RV64) host system running the Linux kernel with KVM hypervisor support compiled in and active; (2) an attacker-controlled guest VM executing on that host - either a directly launched guest or a nested guest (the KASAN trace was triggered by a nested guest calling init/1); (3) the SBI PMU extension must be exposed to the guest (the default KVM configuration on RISC-V exposes SBI extensions). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 with S:C correctly reflects the VM-escape threat model: a low-privileged guest process (PR:L, AV:L) can corrupt host kernel heap memory with no user interaction, potentially achieving full host compromise (C:H/I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Linux 7.2.4 and Linux 7.3-rc1 (stable backports also available for 6.18). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux with RISC-V KVM enabled by querying kernel configuration and active module loadings across virtualization hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today