EUVD-2026-80510
GHSA-vj69-mp8q-cfj8
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Local VM-fd holder (AV:L/PR:L), deterministic trigger (AC:L), guest→host boundary (S:C); uninitialized stack read yields bounded leak (C:L) and erratic IRQ behavior (I:L/A:L), not full confidentiality.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc
Variable vector[] is declared on stack in function dmsintc_inject_irq() and sometimes it is used without initialized. Here fix this issue.
AnalysisAI
Uninitialized stack memory in the Linux kernel's LoongArch KVM DMSINTC interrupt-injection path can let a local user who is able to create or control a KVM virtual machine - or code running inside a guest - have non-deterministic stack contents consumed while injecting a dynamic message-signaled interrupt. The vendor rates this 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), while our independent assessment keeps the local, low-privilege, scope-changing profile but lowers the impact components to C:L/I:L/A:L because the leaked data is not reliably attacker-controlled; the affected surface is limited to LoongArch hosts with KVM enabled and DMSINTC in use. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access on a LoongArch host running KVM, plus the ability to open a KVM VM file descriptor and drive DMSINTC (dynamic message-signaled interrupt controller) interrupt injection via dmsintc_inject_irq() - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Vendor CVSS is 7.3 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), placing this local, low-privilege, scope-changing bug in the High band. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the kernel to Linux 7.2.5 or later, or to 7.3-rc1/7.3+, both of which contain the fix (stable commit f56060b0e10fa5633fac1dc243a25da3a5cdafb1 and commit 81aa3a58b542ed88819115c80a17acd86eacb89d, https://git.kernel.org/stable/c/f56060b0e10fa5633fac1dc243a25da3a5cdafb1); downstream LoongArch distributions should pick up the corresponding stable backport rather than re-implementing the change. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all LoongArch Linux hosts running KVM and confirm whether DMSINTC is enabled or used, restrict local VM creation/control and guest access to trusted administrators pending remediation, and review logs for suspicious local VM or guest activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary host file exfiltration from Cloud Hypervisor VMM versions 34.0-50.0. CVSS 10.0. Patch available.
Incorrect handling of queued local TLB flushes in the Linux kernel's KVM nested-VMX (nVMX) implementation can leave stal
Address-rollover bug in the Linux kernel's KVM/arm64 TLB-by-VA invalidation path causes the hypervisor to silently skip
Race conditions in the arm64 KVM path that invalidates VNCR translations can leave a stale stage-1 TLB entry installed f
Missed TLB invalidations in the arm64 KVM nested-virtualization path of the Linux kernel can leave stale translations fo
Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range
A use-after-free (CWE-416) in the Linux kernel's s390/vfio-ap AP crypto passthrough driver allows a local attacker with
The s390 vfio-ap mediated device (mdev) driver in the Linux kernel fails to actually revoke crypto control-domain access
Stale hardware access to unplugged crypto resources in Linux KVM guests on IBM Z (s390) stems from a logic error in the
Stale TLB entries can be reused by an L2 guest in the Linux kernel's KVM nested virtualization (nVMX) implementation on
Linux kernel's KVM nested-VMX (nVMX) emulation can leave stale L2 guest TLB entries on a physical CPU, because KVM execu
Slab use-after-free in the Linux kernel's KVM x86 MMU lockless rmap aging path affects hosts running Linux 6.15 through
Share
External POC / Exploit Code
Leaving vuln.today