CVE-2026-89907

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Validate MSI data before routing it to EIOINTC

pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as

the irq number. The MSI data comes from userspace, that either via a

KVM_IRQ_ROUTING_MSI entry set with KVM_SET_GSI_ROUTING (used by irqfd

and KVM_IRQ_LINE) or directly via KVM_SIGNAL_MSI, and is never checked

against EIOINTC_IRQS.

eiointc_set_irq() uses the value with __set_bit()/__clear_bit() on the

256-bit isr bitmap, eiointc_update_irq() then indexes sw_coremap[] and

the per-cpu coreisr/sw_coreisr bitmaps with it. Therefore a data value

>= 256 reads and writes memory past the end of those arrays, i.e. any

process holding a VM fd can corrupt kernel memory beyond the allocation

of loongarch_eiointc.

Reject MSI data that doesn't fit in the EIOINTC irq space. The DMSINTC

path is unaffected as it decodes the vector from the address and masks

it.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References