Linux Kernel up to 7.2.4 KVM dmsintc_inject_irq stack-based overflow

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.2.4. It has been classified as very critical. The impacted element is the function dmsintc_inject_irq of the component KVM. Performing a manipulation results in stack-based overflow. This vulnerability was named CVE-2026-89910. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.4. It has been classified as very critical. This affects the function dmsintc_inject_irq of the component KVM. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc Variable vector[] is declared on stack in function dmsintc_inject_irq() and sometimes it is used without initialized. Here fix this issue.

The advisory is shared at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-89910 since 09/11/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/16/2026).

Upgrading to version 7.2.5 or 7.3-rc1 eliminates this vulnerability. Applying the patch f56060b0e10fa5633fac1dc243a25da3a5cdafb1/81aa3a58b542ed88819115c80a17acd86eacb89d is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion