CVE-2026-89513: RISC-V: KVM: Fix PMU event info array size overflow
In the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM: Fix PMU event info array size overflow
SBI PMU EVENTGETINFO stores guest-controlled numevents sizeof(einfo) in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one entry but loops over the original numevents, causing out-of-bounds reads and writes. A nested guest triggered:
BUG: KASAN: slab-out-of-bounds in kvmriscvvcpupmueventinfo+0xa4/0x142 Read of size 4 at addr ff600000074d46b0 by task init/1 Call Trace: [<ffffffff8006471c>] kvmriscvvcpupmueventinfo+0xa4/0x142 [<ffffffff800690c0>] kvmsbiextpmuhandler+0xca/0x268 [<ffffffff8006779e>] kvmriscvvcpusbiecall+0xec/0x1e6 [<ffffffff8006008c>] kvmriscvvcpuexit+0x48c/0x540 [<ffffffff8005ea0a>] kvmarchvcpuioctlrun+0x37e/0xc80 Allocated by task 1: kmallocnoprof+0x19e/0x4b0 kvmriscvvcpupmueventinfo+0x72/0x142 kvmsbiextpmuhandler+0xca/0x268 kvmriscvvcpusbiecall+0xec/0x1e6 kvmriscvvcpuexit+0x48c/0x540 kvmarchvcpuioctlrun+0x37e/0xc80 The buggy address is located 0 bytes to the right of allocated 16-byte region [ff600000074d46a0, ff600000074d46b0)
Store the shared-memory size in sizet and reject multiplication overflow. Allocate the guest-driven array with GFPKERNELACCOUNT so it is charged to kmemcg, and use GFPNOWARN to suppress allocation failure warnings. Use kvcalloc() to allow vmalloc fallback and an unsigned long loop index to match numevents.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed?
The issue affects Linux hosts using KVM on RISC-V, where a guest can invoke the SBI PMU EVENT_GET_INFO operation. The reported trigger came from a nested guest.
What does an attacker need to control to trigger the flaw?
An attacker needs control of the guest-supplied num_events value passed to SBI PMU EVENT_GET_INFO. On RV64, a value of 0x10000001 causes the 32-bit allocation-size calculation to truncate while KVM continues iterating over the original value.
How can I identify a likely occurrence?
A KASAN report may show a slab-out-of-bounds read or write in kvm_riscv_vcpu_pmu_event_info, reached through kvm_sbi_ext_pmu_handler and kvm_riscv_vcpu_sbi_ecall. The example report identifies access immediately beyond an allocated 16-byte region.