CVE-2026-89907: LoongArch: KVM: Validate MSI data before routing it to EIOINTC
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: KVM: Validate MSI data before routing it to EIOINTC
pchmsisetirq() passes e->msi.data straight into eiointcsetirq() as the irq number. The MSI data comes from userspace, that either via a KVMIRQROUTINGMSI entry set with KVMSETGSIROUTING (used by irqfd and KVMIRQLINE) or directly via KVMSIGNALMSI, and is never checked against EIOINTCIRQS.
eiointcsetirq() uses the value with setbit()/clearbit() on the 256-bit isr bitmap, eiointcupdateirq() then indexes swcoremap[] and the per-cpu coreisr/swcoreisr bitmaps with it. Therefore a data value = 256 reads and writes memory past the end of those arrays, i.e. any process holding a VM fd can corrupt kernel memory beyond the allocation of loongarcheiointc.
Reject MSI data that doesn't fit in the EIOINTC irq space. The DMSINTC path is unaffected as it decodes the vector from the address and masks it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (KVM IRQ routing for LoongArch EIOINTC)to a version that resolves this vulnerability.Patch LoongArch: KVM: Validate MSI data before routing it to EIOINTC
Event History
Frequently Asked Questions
Who can trigger the memory corruption?
Any process that holds a VM file descriptor can trigger it by supplying MSI data through the affected LoongArch KVM EIOINTC path. The issue is in kernel handling of userspace-provided MSI values.
What input is required for exploitation?
The attacker needs to provide an MSI data value of 256 or greater. This can be supplied through a KVM_IRQ_ROUTING_MSI entry using KVM_SET_GSI_ROUTING, including irqfd or KVM_IRQ_LINE use, or directly through KVM_SIGNAL_MSI.
Is every MSI interrupt-controller path affected?
No. The DMSINTC path is unaffected because it derives the vector from the address and masks it, rather than using the unvalidated MSI data value as the interrupt number.