HIGH Introduced in 6.18
riscv kvm PmuEventInfo Overflow
CVE-2026-89513
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI7.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo) in a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one entry but loops over the original num_events, causing out-of-bounds reads and writes. A nested guest triggered: BUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info+0xa4/0x142 Read of size 4 at addr ff600000074d46b0 by task init/1 Call Trace: [<ffffffff8006471c>] kvm_riscv_vcpu_pmu_event_info+0xa4/0x142 [<ffffffff800690c0>] kvm_sbi_ext_pmu_handler+0xca/0x268 [<ffffffff8006779e>] kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6 [<ffffffff8006008c>] kvm_riscv_vcpu_exit+0x48c/0x540 [<ffffffff8005ea0a>] kvm_arch_vcpu_ioctl_run+0x37e/0xc80 Allocated by task 1: __kmalloc_noprof+0x19e/0x4b0 kvm_riscv_vcpu_pmu_event_info+0x72/0x142 kvm_sbi_ext_pmu_handler+0xca/0x268 kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6 kvm_riscv_vcpu_exit+0x48c/0x540 kvm_arch_vcpu_ioctl_run+0x37e/0xc80 The buggy address is located 0 bytes to the right of allocated 16-byte region [ff600000074d46a0, ff600000074d46b0) Store the shared-memory size in size_t and reject multiplication overflow. Allocate the guest-driven array with GFP_KERNEL_ACCOUNT so it is charged to kmemcg, and use __GFP_NOWARN to suppress allocation failure warnings. Use kvcalloc() to allow vmalloc fallback and an unsigned long loop index to match num_events.
02KernelScan AI Analysis
Risk summary
A guest VM on a RISC-V KVM host can trigger an integer overflow in the PMU event info handler, causing the host kernel to allocate a too-small buffer and then read and write out of bounds. This can be exploited by a malicious guest to corrupt host kernel memory, leading to denial of service or potentially privilege escalation on the host. The bug is reachable by any guest that can issue SBI PMU calls, including nested guests.
Vulnerability analysis
A guest VM on a RISC-V KVM host can supply a crafted event count to the SBI PMU event info handler. The original code stored the product of the event count and the entry size in a 32-bit integer, which silently truncated on 64-bit systems. The host then allocated a buffer based on the truncated size but iterated over the original count, reading and writing past the end of the allocated memory. The fix computes the buffer size in a 64-bit type, rejects the request if the multiplication overflows, and uses a calloc-style allocator with vmalloc fallback. The vulnerable path is reached when a guest issues an SBI PMU EVENT_GET_INFO call, so any guest with access to the KVM virtual CPU run ioctl can trigger it, including unprivileged nested guests.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.18 | 6.18.57 | ddbd71a37809 |
| 7.2 | 6.18 | 7.2.4 | 82088f88c96b |
| mainline | 6.18 | 7.3 | 735bc20c2418 |