CVE-2026-89904 Overview
CVE-2026-89904 is a Linux kernel vulnerability affecting the LoongArch architecture. The flaw is an array overflow in acpi_package_ids[] triggered when parsing the Processor Properties Topology Table (PPTT) on LoongArch virtual machines. A typical LoongArch virt configuration assigns one core per socket and supports up to 256 sockets per VM, exceeding the static array bounds. Local attackers with the ability to influence firmware topology data or run code on affected systems can trigger memory corruption, leading to elevated privileges or denial of service.
Critical Impact
An out-of-bounds write in kernel memory can corrupt adjacent structures on LoongArch virtualized hosts, enabling privilege escalation or system compromise.
Affected Products
- Linux kernel on the LoongArch architecture
- LoongArch virt machine deployments using ACPI PPTT topology
- Kernel builds prior to commits 0195e04b, 2a2367d, 6311b8c, and d3fd094c
Discovery Timeline
- 2026-09-16 - CVE-2026-89904 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89904
Vulnerability Analysis
The vulnerability resides in the LoongArch ACPI initialization path where the kernel iterates over processor package identifiers reported by the PPTT. The acpi_package_ids[] array was statically sized without accounting for the maximum number of sockets supported by a LoongArch virt machine. When one core is assigned per socket, the platform can present up to 256 packages, exceeding the array bounds during enumeration.
This produces an out-of-bounds write into kernel memory. Adjacent kernel structures can be overwritten with attacker-influenced values derived from ACPI table content, corrupting kernel state during early boot or CPU hotplug operations. The consequence is potential kernel memory corruption impacting confidentiality, integrity, and availability of the affected host.
Root Cause
The root cause is an undersized static buffer. The acpi_package_ids[] array declaration did not reference MAX_PACKAGES or KVM_MAX_VCPUS, so writes indexed by the parsed PPTT package count exceeded array bounds. The upstream fix resizes the array using the maximum of MAX_PACKAGES and KVM_MAX_VCPUS to accommodate large VM topologies.
Attack Vector
Exploitation requires local access to the affected LoongArch system or control of the virtualization topology presented to the guest. An attacker able to shape the PPTT contents, for example through a malicious hypervisor configuration or crafted firmware, can trigger the overflow during kernel initialization. Because the flaw executes in kernel context, successful exploitation can yield privilege escalation or persistent denial of service.
The vulnerability is described in the upstream commits referenced by the kernel maintainers. See the Kernel Git Commit 0195e04b and Kernel Git Commit d3fd094c for the corrective changes.
Detection Methods for CVE-2026-89904
Indicators of Compromise
- Unexpected kernel panics or oops messages on LoongArch virt hosts during boot or CPU hotplug involving ACPI PPTT parsing
- Kernel log entries referencing acpi_package_ids or PPTT topology enumeration errors
- Anomalous kernel memory corruption warnings on systems with high socket counts (>64 packages)
Detection Strategies
- Inventory LoongArch systems and virtual machines to identify hosts running kernels prior to the patched commits
- Audit hypervisor configurations that expose more than 64 sockets to LoongArch guests via PPTT
- Correlate kernel crash telemetry with ACPI table parsing routines to identify potentially affected boots
Monitoring Recommendations
- Forward kernel logs from LoongArch hosts to a centralized log platform and alert on ACPI or PPTT parsing errors
- Monitor for repeated kernel panics on virtualization hosts, which may indicate exploitation attempts or unstable topology configurations
- Track kernel package versions across the LoongArch fleet and flag builds that do not include the upstream fix
How to Mitigate CVE-2026-89904
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the commits 0195e04b, 2a2367d, 6311b8c, and d3fd094c to all LoongArch systems
- Restrict local access to affected LoongArch hosts and virtualization management interfaces until patches are deployed
- Reduce guest socket counts on unpatched LoongArch VMs to values below the vulnerable threshold where operationally feasible
Patch Information
The fix redefines the acpi_package_ids[] array using the maximum of MAX_PACKAGES and KVM_MAX_VCPUS, preventing the overflow when parsing PPTT entries on high-socket LoongArch VMs. Patched builds are available through the mainline and stable kernel trees. Reference the Kernel Git Commit 2a2367d and Kernel Git Commit 6311b8c for the exact changes.
Workarounds
- Configure LoongArch guests with fewer sockets per VM to stay below the array boundary until the kernel is patched
- Limit exposure of hypervisor topology configuration to trusted administrators
- Rebuild affected kernels from source with the corrective patches backported when distribution updates are not yet available
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.