Linux Kernel CVE-2026-89907

Requires a LoongArch host with KVM enabled and the attacker holding a VM file descriptor (access to /dev/kvm to create a VM). The attacker then supplies an MSI data value >= EIOINTC_IRQS (256) through KVM_SET_GSI_ROUTING (irqfd/KVM_IRQ_LINE) or KVM_SIGNAL_MSI, which is routed unvalidated into EIOINTC. Limiting factors: exploitation is confined to the LoongArch architecture with KVM in use; the DMSINTC path is not affected because it decodes and masks the vector from the address; and it needs local access to KVM interfaces (PR:L) rather than remote reach. Within those constraints the write is deterministic and fully attacker-controlled - no race, no user interaction.

This is one of the few genuinely well-scored CVEs in the recent LoongArch KVM cluster. The vendor CVSS of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is defensible rather than inflated: unlike the sibling LoongArch race-condition bugs, this is a deterministic, attacker-controlled out-of-bounds write. Any process holding a KVM VM fd supplies an MSI data value >= 256 (via KVM_SET_GSI_ROUTING/irqfd/KVM_IRQ_LINE or KVM_SIGNAL_MSI), which pch_msi_set_irq() feeds unchecked into eiointc_set_irq(), driving __set_bit()/__clear_bit() and sw_coremap[]/coreisr indexing past the loongarch_eiointc allocation - a controlled OOB write primitive into HOST kernel memory. AC:L is honest here because the attacker directly controls the index with no race to win. S:C correctly captures the guest/VM-to-host confinement escape. C:H/I:H/A:H are justified because a controlled kernel OOB write can escalate to full host compromise. No CVSS 4.0 vector, EPSS, KEV, POC, or SSVC data was provided. Exploitation status: no public exploit identified at time of analysis, and there is no evidence of active exploitation. The main mitigating factor is deployment scope - this affects only LoongArch hosts running KVM, a niche architecture, so real-world priority is high for the small population of LoongArch virtualization operators and low for everyone else. One data-quality caveat: the input CWE is N/A and the 'Information Disclosure' tag mislabels this - the primary impact is a memory-corruption OOB write (CWE-787), not disclosure.

A local unprivileged user (or a semi-trusted virtualization tenant) with access to /dev/kvm on a LoongArch host creates a VM and issues KVM_SIGNAL_MSI or configures GSI routing with an MSI data field >= 256. The kernel routes that value directly into the EIOINTC bitmap logic, writing bits past the per-cpu coreisr/sw_coreisr arrays and corrupting host kernel memory, which can be shaped into privilege escalation or a host crash. No public exploit code is identified at this time.