CVE-2026-89904 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Fix acpi_package_ids[] array overflow
With LoongArch virt machine, a typical setting is one core per socket, there will max 256 sockets (packages) on one VM. With PPTT acpi table, array acpi_package_ids[] will be overflowed.
Here change the array size of acpi_package_ids[] with the max value of
MAX_PACKAGES and KVM_MAX_VCPUS.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel contains a buffer overflow vulnerability within the ACPI processor topology parsing logic for the LoongArch architecture, specifically affecting virtual machine environments that utilize one core per socket configuration. This flaw arises in the handling of the Processor Property Topology Table (PPTT), which is an ACPI table used by operating systems to discover and understand the hierarchical structure of processors, including sockets, cores, and threads. In typical LoongArch virtualized deployments, a single virtual machine can be configured with up to two hundred fifty-six sockets or packages. The kernel maintains an array named acpi_package_ids[] to track these package identifiers during initialization. However, prior to this fix, the size of this array was insufficient to accommodate the maximum number of supported sockets in such high-density configurations. When the system attempts to populate this array with identifiers for all available sockets, it exceeds the allocated memory bounds, leading to a classic stack or heap buffer overflow depending on where the array is defined and used within the kernel codebase.
This vulnerability represents an out-of-bounds write operation that can corrupt adjacent memory structures in the kernel space. The technical root cause lies in the static definition of the acpi_package_ids[] array not being dynamically sized or sufficiently large to handle the theoretical maximum number of packages as dictated by hardware and virtualization constraints. By failing to account for the upper limit defined by MAX_PACKAGES and KVM_MAX_VCPUS, the kernel allows writes beyond the intended memory boundary when processing PPTT data on systems with extensive socket counts. This type of flaw is categorized under CWE-120 Buffer Copy without Checking Size of Input or CWE-787 Out-of-bounds Write in standard vulnerability classification schemes. The lack of bounds checking during the population of this identifier array creates a direct path for memory corruption, which can destabilize the kernel's internal data structures and lead to unpredictable behavior upon execution.
The operational impact of this buffer overflow is significant as it compromises the integrity and availability of the host system running the virtual machine. An attacker with local access who can influence or trigger the ACPI table parsing process could potentially exploit this memory corruption to execute arbitrary code within kernel space, thereby gaining full control over the underlying hardware and any other virtual machines hosted on that node. Even without malicious intent, a simple misconfiguration leading to high socket counts could cause a kernel panic due to memory corruption, resulting in a denial of service for all workloads running on the affected system. The vulnerability highlights the critical importance of aligning internal data structures with external hardware specifications and virtualization limits to prevent such boundary violations during early boot or runtime topology discovery phases.
To mitigate this risk, it is essential to apply the kernel patch that increases the size of the acpi_package_ids[] array to match the maximum supported values for packages and VCPUs as defined by MAX_PACKAGES and KVM_MAX_VCPUS respectively. This ensures that the buffer has sufficient capacity to hold all package identifiers without overflowing into adjacent memory regions. Administrators should ensure their Linux kernels are updated to versions containing this fix, particularly if they operate LoongArch virtual machines with high socket counts. Furthermore, implementing strict input validation and bounds checking in ACPI parsing routines can serve as a defense-in-depth measure against similar vulnerabilities across different architectures. Regular security audits focusing on memory safety in kernel subsystems that handle hardware topology data are recommended to identify and remediate such out-of-bounds access issues before they can be exploited or cause system instability.