Linux Kernel up to 7.2.4/7.3-rc1 KVM pch_msi_set_irq data out-of-bounds write

Summaryinfo

A vulnerability has been found in Linux Kernel up to 7.2.4/7.3-rc1 and classified as very critical. Impacted is the function pch_msi_set_irq of the component KVM. This manipulation of the argument data causes out-of-bounds write. This vulnerability is handled as CVE-2026-89907. It is possible to launch the attack on the local host. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 7.2.4/7.3-rc1 and classified as very critical. Affected by this vulnerability is the function pch_msi_set_irq of the component KVM. The manipulation of the argument data with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as the irq number. The MSI data comes from userspace, that either via a KVM_IRQ_ROUTING_MSI entry set with KVM_SET_GSI_ROUTING (used by irqfd and KVM_IRQ_LINE) or directly via KVM_SIGNAL_MSI, and is never checked against EIOINTC_IRQS. eiointc_set_irq() uses the value with __set_bit()/__clear_bit() on the 256-bit isr bitmap, eiointc_update_irq() then indexes sw_coremap[] and the per-cpu coreisr/sw_coreisr bitmaps with it. Therefore a data value >= 256 reads and writes memory past the end of those arrays, i.e. any process holding a VM fd can corrupt kernel memory beyond the allocation of loongarch_eiointc. Reject MSI data that doesn't fit in the EIOINTC irq space. The DMSINTC path is unaffected as it decodes the vector from the address and masks it.

It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2026-89907 since 09/11/2026. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/16/2026).

Upgrading to version 7.2.5 or 7.3-rc2 eliminates this vulnerability. Applying the patch 83715a40a2d30d23719e0b25380ba82ff905195b is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.3-rc1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion