HIGH Introduced in 6.13
kvm MsiData OOB
CVE-2026-89907
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI8.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as the irq number. The MSI data comes from userspace, that either via a KVM_IRQ_ROUTING_MSI entry set with KVM_SET_GSI_ROUTING (used by irqfd and KVM_IRQ_LINE) or directly via KVM_SIGNAL_MSI, and is never checked against EIOINTC_IRQS. eiointc_set_irq() uses the value with __set_bit()/__clear_bit() on the 256-bit isr bitmap, eiointc_update_irq() then indexes sw_coremap[] and the per-cpu coreisr/sw_coreisr bitmaps with it. Therefore a data value >= 256 reads and writes memory past the end of those arrays, i.e. any process holding a VM fd can corrupt kernel memory beyond the allocation of loongarch_eiointc. Reject MSI data that doesn't fit in the EIOINTC irq space. The DMSINTC path is unaffected as it decodes the vector from the address and masks it.
02KernelScan AI Analysis
Risk summary
A local process with access to /dev/kvm on a LoongArch host can supply a crafted MSI data value that bypasses bounds checks in the KVM EIOINTC interrupt controller emulation, causing out-of-bounds reads and writes on kernel heap arrays. This enables kernel memory corruption, potentially leading to privilege escalation, information disclosure, or denial of service. The vulnerability affects any LoongArch system running KVM where untrusted or semi-trusted users have access to virtual machine file descriptors.
Vulnerability analysis
The KVM interrupt routing code for LoongArch accepts MSI data values from userspace without checking whether they fall within the valid interrupt range. A process that has a KVM virtual machine file descriptor can supply an arbitrarily large MSI data value through the interrupt routing or signal-MSI ioctls, and that value is used directly as an index into fixed-size interrupt bitmaps and per-CPU arrays inside the EIOINTC interrupt controller emulation. Values at or above 256 read and write past the end of those arrays, corrupting kernel heap memory beyond the interrupt controller's allocation. The fix adds a bounds check that rejects MSI data outside the EIOINTC interrupt space before it reaches the interrupt controller. This is reachable locally by any process with access to /dev/kvm on a LoongArch host running KVM, with no special privileges beyond the ability to open a VM file descriptor.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.13 | 7.2.5 | 83715a40a2d3 |
| mainline | 6.13 | 7.3-rc2 | 501514d6ebd2 |