HIGH Introduced in 7.1
kvm DmsintcInject Uninit
CVE-2026-89910
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
KernelScan AI7.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc Variable vector[] is declared on stack in function dmsintc_inject_irq() and sometimes it is used without initialized. Here fix this issue.
02KernelScan AI Analysis
Risk summary
A guest VM running on a LoongArch KVM host can trigger use of an uninitialized stack variable in the DMSINTC interrupt injection path, potentially causing spurious or invalid interrupt injection into a vCPU. The primary impact is host kernel availability (panic or oops), with limited potential for info leak or integrity violation. Only systems running KVM on LoongArch hardware with untrusted guest VMs are affected.
Vulnerability analysis
In the LoongArch KVM hypervisor's interrupt injection path, a local variable is sometimes used before it is initialized, leaving it containing whatever garbage was on the stack. That uninitialized value is then checked to decide whether and how to inject an interrupt into a guest vCPU, which can cause spurious or invalid interrupt delivery. The fix always initializes the variable to zero when there is no valid interrupt to inject, so later checks operate on clean data. A malicious guest VM running on a LoongArch KVM host can reach this path through normal interrupt injection operations and needs no special privileges within the guest to trigger it.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 7.1 | 7.3-rc1 | 81aa3a58b542 |
| 7.2 | 7.1 | 7.2.5 | f56060b0e10f |