{"id":"CVE-2026-89513","revision":"af2b8103dfd54c95b9c8a9769edcf624","records":[{"revision":"af2b8103dfd54c95b9c8a9769edcf624","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89513","aliases":[],"title":"RISC-V: KVM: Fix PMU event info array size overflow","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Fix PMU event info array size overflow\n\nSBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo)\nin a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010\ntruncate to 16. KVM then allocates one entry but loops over the original\nnum_events, causing out-of-bounds reads and writes. A nested guest\ntriggered:\n\nBUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info+0xa4/0x142\nRead of size 4 at addr ff600000074d46b0 by task init/1\nCall Trace:\n[<ffffffff8006471c>] kvm_riscv_vcpu_pmu_event_info+0xa4/0x142\n[<ffffffff800690c0>] kvm_sbi_ext_pmu_handler+0xca/0x268\n[<ffffffff8006779e>] kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6\n[<ffffffff8006008c>] kvm_riscv_vcpu_exit+0x48c/0x540\n[<ffffffff8005ea0a>] kvm_arch_vcpu_ioctl_run+0x37e/0xc80\nAllocated by task 1:\n __kmalloc_noprof+0x19e/0x4b0\n kvm_riscv_vcpu_pmu_event_info+0x72/0x142\n kvm_sbi_ext_pmu_handler+0xca/0x268\n kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6\n kvm_riscv_vcpu_exit+0x48c/0x540\n kvm_arch_vcpu_ioctl_run+0x37e/0xc80\nThe buggy address is located 0 bytes to the right of\n allocated 16-byte region [ff600000074d46a0, ff600000074d46b0)\n\nStore the shared-memory size in size_t and reject multiplication overflow.\nAllocate the guest-driven array with GFP_KERNEL_ACCOUNT so it is charged\nto kmemcg, and use __GFP_NOWARN to suppress allocation failure warnings.\nUse kvcalloc() to allow vmalloc fallback and an unsigned long loop index\nto match num_events.","state":0,"publishedAt":"2026-09-11T19:43:57.96+00:00","modifiedAt":"2026-10-19T08:48:04.61+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/riscv/kvm/vcpu_pmu.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e309fd113b9f6c34672a487be08fecb7e12e7e29\",\n                            \"lessThan\": \"ddbd71a3780942918a7d116d666313e5b3304d73\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e309fd113b9f6c34672a487be08fecb7e12e7e29\",\n                            \"lessThan\": \"82088f88c96b99c27a974d09b02c2b133262fadf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e309fd113b9f6c34672a487be08fecb7e12e7e29\",\n                            \"lessThan\": \"735bc20c24187ca419c9d5e63860a54b91be34bd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/riscv/kvm/vcpu_pmu.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/ddbd71a3780942918a7d116d666313e5b3304d73","https://git.kernel.org/stable/c/82088f88c96b99c27a974d09b02c2b133262fadf","https://git.kernel.org/stable/c/735bc20c24187ca419c9d5e63860a54b91be34bd"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89513","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89513","identifiers":["CVE-2026-89513"]},"retained":false,"historicalAffected":[]}],"coverage":[]}