Linux Kernel CVE-2026-89910

Requires local access on a LoongArch host running KVM, plus the ability to open a KVM VM file descriptor and drive DMSINTC (dynamic message-signaled interrupt controller) interrupt injection via dmsintc_inject_irq() - i.e. an operator/tenant able to create or control a VM, or code running inside a guest. Exploitation is limited to the LoongArch architecture with KVM enabled and DMSINTC in use; it does not apply to non-LoongArch hosts, hosts without KVM, or (per the sibling EIOINTC advisory) the EIOINTC path. Impact is bounded by non-deterministic stack contents, so results are not reliably attacker-controlled.

Vendor CVSS is 7.3 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), placing this local, low-privilege, scope-changing bug in the High band. The vector is internally coherent for a KVM guest→host issue: AV:L and PR:L map to any process holding a KVM VM-fd, and S:C reflects the guest-to-host boundary crossing. However C:H is aggressive for an uninitialized stack read whose disclosure is bounded to whatever stale host kernel-stack contents happen to occupy vector[] before use - realistically a partial, non-deterministic leak plus unpredictable IRQ injection (a plausible A:L the vendor set to A:N). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so all three real-world-exploitation signals are absent. This is a defense-in-depth kernel hardening fix for a niche architecture, not an urgent priority: real risk is far below the 7.3 headline given LoongArch KVM's tiny production footprint and the absence of any exploitation evidence. Note the input Tag 'Code Injection' conflicts with the description (an uninitialized-variable use, not code injection) and should not drive triage.

A local user with permission to open a KVM VM file descriptor (or a malicious/compromised guest) triggers an interrupt-injection path through dmsintc_inject_irq() before the stack-resident vector[] array is initialized, causing the host kernel to act on stale stack data. This may leak fragments of host kernel stack memory into interrupt state or cause unpredictable/incorrect IRQ delivery. No public exploit code is identified at time of analysis.