CVE-2026-89513

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RISC-V: KVM: Fix PMU event info array size overflow

SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo)

in a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010

truncate to 16. KVM then allocates one entry but loops over the original

num_events, causing out-of-bounds reads and writes. A nested guest

triggered:

BUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info+0xa4/0x142

Read of size 4 at addr ff600000074d46b0 by task init/1

Call Trace:

[<ffffffff8006471c>] kvm_riscv_vcpu_pmu_event_info+0xa4/0x142

[<ffffffff800690c0>] kvm_sbi_ext_pmu_handler+0xca/0x268

[<ffffffff8006779e>] kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6

[<ffffffff8006008c>] kvm_riscv_vcpu_exit+0x48c/0x540

[<ffffffff8005ea0a>] kvm_arch_vcpu_ioctl_run+0x37e/0xc80

Allocated by task 1:

__kmalloc_noprof+0x19e/0x4b0

kvm_riscv_vcpu_pmu_event_info+0x72/0x142

kvm_sbi_ext_pmu_handler+0xca/0x268

kvm_riscv_vcpu_sbi_eca

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References