UBUNTU-CVE-2026-89513: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeof(einfo) in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one entry but loops over the original numevents, causing out-of-bounds reads and writes. A nested guest triggered: BUG: KASAN: slab-out-of-bounds in kvmriscvvcpupmueventinfo+0xa4/0x142 Read of size 4 at addr ff600000074d46b0 by task init/1 Call Trace: [<ffffffff8006471c>] kvmriscvvcpupmueventinfo+0xa4/0x142 [<ffffffff800690c0>] kvmsbiextpmuhandler+0xca/0x268 [<ffffffff8006779e>] kvmriscvvcpusbiecall+0xec/0x1e6 [<ffffffff8006008c>] kvmriscvvcpuexit+0x48c/0x540 [<ffffffff8005ea0a>] kvmarchvcpuioctlrun+0x37e/0xc80 Allocated by task 1: kmallocnoprof+0x19e/0x4b0 kvmriscvvcpupmueventinfo+0x72/0x142 kvmsbiextpmuhandler+0xca/0x268 kvmriscvvcpusbiecall+0xec/0x1e6 kvmriscvvcpuexit+0x48c/0x540 kvmarchvcpuioctlrun+0x37e/0xc80 The buggy address is located 0 bytes to the right of allocated 16-byte region [ff600000074d46a0, ff600000074d46b0) Store the shared-memory size in sizet and reject multiplication overflow. Allocate the guest-driven array with GFPKERNELACCOUNT so it is charged to kmemcg, and use GFPNOWARN to suppress allocation failure warnings. Use kvcalloc() to allow vmalloc fallback and an unsigned long loop index to match numevents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Fix RISC-V KVM PMU event info handling by storing the guest-controlled shared-memory size in size_t, rejecting multiplication overflow, allocating the guest-driven array with kvcalloc() using GFP_KERNEL_ACCOUNT and __GFP_NOWARN, and using an unsigned long loop index to match num_events.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects the RISC-V KVM PMU event-information handling path. Systems using the listed Ubuntu kernel packages are relevant where RISC-V KVM is in use, particularly when running nested guests.
What does an attacker need to do to trigger the flaw?
A guest must issue the SBI PMU EVENT_GET_INFO operation with a guest-controlled num_events value. On RV64, num_events set to 0x10000001 causes the allocation-size calculation to truncate while KVM continues processing the original value.
What is the impact of successful exploitation?
The truncated allocation leads KVM to allocate space for one event entry and then read and write beyond that allocation. The reported result is a KASAN-detected slab out-of-bounds access in kvm_riscv_vcpu_pmu_event_info.