CVE-2026-89513: Linux Kernel RISC-V KVM Buffer Overflow

CVE-2026-89513 Overview

CVE-2026-89513 is an integer overflow vulnerability in the Linux kernel's RISC-V Kernel-based Virtual Machine (KVM) subsystem. The flaw resides in the Supervisor Binary Interface (SBI) Performance Monitoring Unit (PMU) EVENT_GET_INFO handler. The handler stores the guest-controlled expression num_events * sizeof(*einfo) in a 32-bit integer. On RV64 systems, a value of num_events = 0x10000001 produces 0x100000010, which truncates to 16. KVM allocates a single 16-byte entry but iterates over the original num_events, causing out-of-bounds reads and writes on kernel slab memory.

Critical Impact
A nested or malicious guest can trigger slab-out-of-bounds access in host kernel memory, enabling potential host compromise, information disclosure, or denial of service.

Affected Products

Linux kernel with RISC-V KVM support (RV64 configurations)
Kernels containing the vulnerable kvm_riscv_vcpu_pmu_event_info implementation prior to the fix
Distributions shipping RISC-V virtualization enabled kernels

Discovery Timeline

2026-09-11 - CVE-2026-89513 published to the National Vulnerability Database (NVD)
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89513

Vulnerability Analysis

The vulnerability affects kvm_riscv_vcpu_pmu_event_info() in the RISC-V KVM PMU handler. When a guest issues the SBI PMU EVENT_GET_INFO call, the host multiplies the guest-supplied num_events by sizeof(*einfo) and stores the product in a 32-bit integer. This arithmetic can wrap around, returning a value far smaller than the true required allocation size.

The host then calls the allocator with the truncated size and receives a small buffer. The subsequent processing loop still uses the untruncated num_events value as its iteration bound. Each loop iteration reads from and writes to the guest-driven event info array, quickly stepping past the end of the underlying slab object.

KASAN captured the resulting slab-out-of-bounds read of size 4 at offset 0 beyond a 16-byte allocation. The corruption is reachable through kvm_sbi_ext_pmu_handler and kvm_riscv_vcpu_sbi_ecall during standard KVM_RUN ioctl handling, meaning any local user able to run a KVM guest can invoke the vulnerable path.

Root Cause

The root cause is a numeric truncation error [CWE-681] combined with an integer overflow [CWE-190] in size calculation. The size expression was assigned to a 32-bit type while the loop index and the guest input operate on wider values. The mismatch between allocation size and loop bound produces the out-of-bounds access.

Attack Vector

Exploitation requires local access with the ability to launch a KVM guest on an affected RISC-V host. A guest crafts an SBI PMU EVENT_GET_INFO request with a large num_events value chosen so that the 32-bit multiplication truncates to a small allocation size. When the host loops over the original count, it reads and writes adjacent slab memory, which can be shaped through slab spraying to target sensitive kernel objects.

The upstream fix stores the shared-memory size in size_t, rejects multiplication overflow, switches to kvcalloc() with GFP_KERNEL_ACCOUNT | __GFP_NOWARN to allow vmalloc fallback and kmemcg accounting, and uses an unsigned long loop index consistent with num_events.

Detection Methods for CVE-2026-89513

Indicators of Compromise

KASAN reports referencing slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info in kernel logs
Unexpected BUG: traces containing kvm_sbi_ext_pmu_handler and kvm_riscv_vcpu_sbi_ecall frames
Guest VMs issuing SBI PMU EVENT_GET_INFO calls with unusually large num_events values

Detection Strategies

Monitor host dmesg and journal output on RISC-V hypervisors for KASAN or slab corruption warnings linked to the KVM PMU path
Audit running kernel versions on RISC-V hosts and compare against the patched commits 735bc20c24187ca419c9d5e63860a54b91be34bd and 82088f88c96b99c27a974d09b02c2b133262fadf
Instrument tracepoints on kvm_sbi_ext_pmu_handler to log guest-supplied argument ranges for anomaly review

Monitoring Recommendations

Forward kernel logs from RISC-V virtualization hosts to a centralized log platform for retention and correlation
Alert on repeated KVM guest crashes or host oops events originating from the SBI PMU handler
Track guest workloads that repeatedly invoke SBI PMU services outside of normal telemetry patterns

How to Mitigate CVE-2026-89513

Immediate Actions Required

Apply the upstream stable kernel updates that include commits 735bc20c24187ca419c9d5e63860a54b91be34bd and 82088f88c96b99c27a974d09b02c2b133262fadf
Rebuild and redeploy affected RISC-V hypervisor kernels, then reboot host systems to load the patched code
Restrict local host access on RISC-V virtualization hosts to trusted operators until patches are applied

Patch Information

The fix is available in the mainline and stable Linux kernel trees. See the kernel commit 735bc20c and the kernel commit 82088f88 for the patched implementation. The corrected code stores the size in size_t, validates against multiplication overflow, uses kvcalloc() with GFP_KERNEL_ACCOUNT and __GFP_NOWARN, and switches the loop index to unsigned long.

Workarounds

Disable RISC-V KVM on hosts that do not require guest virtualization until the patched kernel is deployed
Prevent untrusted users from creating or running KVM guests on RISC-V hosts by tightening /dev/kvm permissions
Restrict nested virtualization on RISC-V systems where the vulnerable PMU path can be reached from a nested guest

bash

# Restrict /dev/kvm access to a dedicated group as a temporary workaround
sudo groupadd kvm-admins
sudo chown root:kvm-admins /dev/kvm
sudo chmod 660 /dev/kvm

# Verify running kernel version after patch deployment
uname -r