CVE-2026-89907: LoongArch: KVM: Validate MSI data before routing it to EIOINTC

Published Sep 16, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Validate MSI data before routing it to EIOINTC

pchmsisetirq() passes e->msi.data straight into eiointcsetirq() as the irq number. The MSI data comes from userspace, that either via a KVMIRQROUTINGMSI entry set with KVMSETGSIROUTING (used by irqfd and KVMIRQLINE) or directly via KVMSIGNALMSI, and is never checked against EIOINTCIRQS.

eiointcsetirq() uses the value with setbit()/clearbit() on the 256-bit isr bitmap, eiointcupdateirq() then indexes swcoremap[] and the per-cpu coreisr/swcoreisr bitmaps with it. Therefore a data value = 256 reads and writes memory past the end of those arrays, i.e. any process holding a VM fd can corrupt kernel memory beyond the allocation of loongarcheiointc.

Reject MSI data that doesn't fit in the EIOINTC irq space. The DMSINTC path is unaffected as it decodes the vector from the address and masks it.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Linux kernel (KVM IRQ routing for LoongArch EIOINTC) to a version that resolves this vulnerability.

    Patch LoongArch: KVM: Validate MSI data before routing it to EIOINTC

Event History

Sep 16, 2026
CVE Published
via MITRE·10:32 AM
Data Sourced
via MITRE·10:32 AM
Description

Frequently Asked Questions

1

Who can trigger the memory corruption?

Any process that holds a VM file descriptor can trigger it by supplying MSI data through the affected LoongArch KVM EIOINTC path. The issue is in kernel handling of userspace-provided MSI values.

2

What input is required for exploitation?

The attacker needs to provide an MSI data value of 256 or greater. This can be supplied through a KVM_IRQ_ROUTING_MSI entry using KVM_SET_GSI_ROUTING, including irqfd or KVM_IRQ_LINE use, or directly through KVM_SIGNAL_MSI.

3

Is every MSI interrupt-controller path affected?

No. The DMSINTC path is unaffected because it derives the vector from the address and masks it, rather than using the unvalidated MSI data value as the interrupt number.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203