CVE-2026-89513

Received Received - Intake

Buffer Overflow in Linux Kernel KVM RISC-V PMU

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo) in a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one entry but loops over the original num_events, causing out-of-bounds reads and writes. A nested guest triggered: BUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info+0xa4/0x142 Read of size 4 at addr ff600000074d46b0 by task init/1 Call Trace: [<ffffffff8006471c>] kvm_riscv_vcpu_pmu_event_info+0xa4/0x142 [<ffffffff800690c0>] kvm_sbi_ext_pmu_handler+0xca/0x268 [<ffffffff8006779e>] kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6 [<ffffffff8006008c>] kvm_riscv_vcpu_exit+0x48c/0x540 [<ffffffff8005ea0a>] kvm_arch_vcpu_ioctl_run+0x37e/0xc80 Allocated by task 1: __kmalloc_noprof+0x19e/0x4b0 kvm_riscv_vcpu_pmu_event_info+0x72/0x142 kvm_sbi_ext_pmu_handler+0xca/0x268 kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6 kvm_riscv_vcpu_exit+0x48c/0x540 kvm_arch_vcpu_ioctl_run+0x37e/0xc80 The buggy address is located 0 bytes to the right of allocated 16-byte region [ff600000074d46a0, ff600000074d46b0) Store the shared-memory size in size_t and reject multiplication overflow. Allocate the guest-driven array with GFP_KERNEL_ACCOUNT so it is charged to kmemcg, and use __GFP_NOWARN to suppress allocation failure warnings. Use kvcalloc() to allow vmalloc fallback and an unsigned long loop index to match num_events.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89513

EUVD

EUVD-2026-76419

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the RISC-V KVM (Kernel-based Virtual Machine) implementation. It involves an array size overflow in the PMU (Performance Monitoring Unit) event info handling. A guest-controlled value causes an integer truncation that leads to out-of-bounds memory access during reads and writes in the KVM subsystem.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation on RISC-V systems. Detection requires checking kernel logs for KASAN slab-out-of-bounds errors related to kvm_riscv_vcpu_pmu_event_info. Monitor dmesg or /var/log/kern.log for messages like 'BUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info'.

Impact Analysis

This vulnerability could allow a malicious guest operating system to trigger memory corruption in the host kernel. This may lead to crashes, privilege escalation, or arbitrary code execution on the host system. Systems running vulnerable Linux kernels with KVM enabled for RISC-V guests are at risk.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this issue. The patch involves changes to KVM's RISC-V PMU event handling. If immediate patching is not possible, consider disabling KVM on RISC-V systems or restricting nested virtualization as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-89513. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70