EUVD-2026-80507
GHSA-fvq2-363j-rc9x
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local VM-fd access (AV:L/PR:L), deterministic attacker-controlled OOB write with no race (AC:L), guest-to-host escape (S:C), and controlled host-kernel corruption yields full C/I/A impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: KVM: Validate MSI data before routing it to EIOINTC
pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as the irq number. The MSI data comes from userspace, that either via a KVM_IRQ_ROUTING_MSI entry set with KVM_SET_GSI_ROUTING (used by irqfd and KVM_IRQ_LINE) or directly via KVM_SIGNAL_MSI, and is never checked against EIOINTC_IRQS.
eiointc_set_irq() uses the value with __set_bit()/__clear_bit() on the 256-bit isr bitmap, eiointc_update_irq() then indexes sw_coremap[] and the per-cpu coreisr/sw_coreisr bitmaps with it. Therefore a data value >= 256 reads and writes memory past the end of those arrays, i.e. any process holding a VM fd can corrupt kernel memory beyond the allocation of loongarch_eiointc.
Reject MSI data that doesn't fit in the EIOINTC irq space. The DMSINTC path is unaffected as it decodes the vector from the address and masks it.
AnalysisAI
Out-of-bounds kernel memory corruption in the Linux kernel's LoongArch KVM EIOINTC interrupt-routing code allows a local attacker who holds a VM file descriptor to read and write memory beyond the loongarch_eiointc allocation. The MSI data field supplied by userspace through KVM_SET_GSI_ROUTING (irqfd/KVM_IRQ_LINE) or KVM_SIGNAL_MSI is passed unchecked into eiointc_set_irq() and used as an IRQ index against 256-bit bitmaps and the sw_coremap[]/coreisr/sw_coreisr arrays, so any value of 256 or greater triggers deterministic, fully attacker-controlled out-of-bounds accesses with scope change from the guest process into kernel memory (CVSS 3.1 8.8, AV:L/PR:L/S:C). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a LoongArch host with KVM enabled and the attacker holding a VM file descriptor (access to /dev/kvm to create a VM). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is one of the few genuinely well-scored CVEs in the recent LoongArch KVM cluster. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix by upgrading to a Linux kernel that contains the referenced stable commits - specifically the 7.2.5 stable release or 7.3-rc2, or any later version (patches: https://git.kernel.org/stable/c/83715a40a2d30d23719e0b25380ba82ff905195b and https://git.kernel.org/stable/c/501514d6ebd2111c353a1296f25dbe22fbd64657); see also https://nvd.nist.gov/vuln/detail/CVE-2026-89907. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all LoongArch-based hosts running KVM and confirm whether the kernel version is affected per your vendor's advisory for CVE-2026-89907, then install the vendor-released patched kernel and reboot; as an immediate interim measure, restrict membership in the 'kvm' group and access to /dev/kvm to fully trusted administrators only, disable KVM on any LoongArch host that does not require virtualization, and monitor kernel logs for out-of-bounds or KVM interrupt-routing errors. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary host file exfiltration from Cloud Hypervisor VMM versions 34.0-50.0. CVSS 10.0. Patch available.
Incorrect handling of queued local TLB flushes in the Linux kernel's KVM nested-VMX (nVMX) implementation can leave stal
Address-rollover bug in the Linux kernel's KVM/arm64 TLB-by-VA invalidation path causes the hypervisor to silently skip
Race conditions in the arm64 KVM path that invalidates VNCR translations can leave a stale stage-1 TLB entry installed f
Missed TLB invalidations in the arm64 KVM nested-virtualization path of the Linux kernel can leave stale translations fo
Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range
A use-after-free (CWE-416) in the Linux kernel's s390/vfio-ap AP crypto passthrough driver allows a local attacker with
The s390 vfio-ap mediated device (mdev) driver in the Linux kernel fails to actually revoke crypto control-domain access
Stale hardware access to unplugged crypto resources in Linux KVM guests on IBM Z (s390) stems from a logic error in the
Stale TLB entries can be reused by an L2 guest in the Linux kernel's KVM nested virtualization (nVMX) implementation on
Linux kernel's KVM nested-VMX (nVMX) emulation can leave stale L2 guest TLB entries on a physical CPU, because KVM execu
Slab use-after-free in the Linux kernel's KVM x86 MMU lockless rmap aging path affects hosts running Linux 6.15 through
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today