CVE-2026-89907: Linux Kernel KVM Privilege Escalation Flaw

CVE-2026-89907 Overview

CVE-2026-89907 is an out-of-bounds read and write vulnerability in the Linux kernel's LoongArch KVM implementation. The flaw resides in pch_msi_set_irq(), which passes attacker-controlled e->msi.data directly into eiointc_set_irq() as an interrupt request (IRQ) number without validating it against EIOINTC_IRQS. A local attacker holding a VM file descriptor can supply Message Signaled Interrupt (MSI) data greater than or equal to 256 and corrupt kernel memory beyond the loongarch_eiointc allocation. The upstream fix rejects MSI data that does not fit in the Extended I/O Interrupt Controller (EIOINTC) IRQ space.

Critical Impact
Any local process holding a KVM VM file descriptor can trigger kernel memory corruption on LoongArch hosts, enabling privilege escalation or host compromise from a guest control path.

Affected Products

Linux kernel on LoongArch architecture with KVM enabled
Kernel builds exposing pch_msi_set_irq() prior to commits 501514d and 83715a4
Hosts permitting unprivileged access to KVM VM file descriptors (for example, virtualization stacks running with /dev/kvm access)

Discovery Timeline

2026-09-16 - CVE-2026-89907 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89907

Vulnerability Analysis

The vulnerability is a kernel out-of-bounds write and read [CWE-787 / CWE-125] in the LoongArch KVM EIOINTC emulation path. The function pch_msi_set_irq() accepts an MSI routing entry whose msi.data field originates from userspace through KVM_SET_GSI_ROUTING (used by irqfd and KVM_IRQ_LINE) or KVM_SIGNAL_MSI. That value is forwarded to eiointc_set_irq() as the IRQ number without any bounds check.

eiointc_set_irq() then uses the untrusted value with __set_bit() and __clear_bit() against a 256-bit isr bitmap. Downstream, eiointc_update_irq() indexes the sw_coremap[] table along with the per-CPU coreisr and sw_coreisr bitmaps using the same value. Supplying a data value of 256 or greater walks off the end of these arrays and corrupts adjacent kernel memory.

Root Cause

The root cause is missing input validation on a userspace-controllable interrupt number before it is used as an index into fixed-size kernel bitmaps and arrays. The EIOINTC IRQ space is bounded by EIOINTC_IRQS, but the emulation code trusted the guest-supplied value without enforcing that bound.

Attack Vector

An attacker requires local access and a valid KVM VM file descriptor. By issuing KVM_SIGNAL_MSI or by configuring a malicious MSI routing entry through KVM_SET_GSI_ROUTING and triggering it via irqfd or KVM_IRQ_LINE, the attacker forces pch_msi_set_irq() to invoke eiointc_set_irq() with an out-of-range IRQ. The resulting bit operations corrupt memory beyond the loongarch_eiointc allocation. The Direct MSI (DMSINTC) path is unaffected because it decodes the vector from the address and masks it.

No verified public exploit code is available. See the upstream commits Kernel Git Commit 501514d and Kernel Git Commit 83715a4 for the source-level fix.

Detection Methods for CVE-2026-89907

Indicators of Compromise

Unexpected kernel oops, panics, or KASAN reports referencing eiointc_set_irq, eiointc_update_irq, pch_msi_set_irq, sw_coremap, or coreisr on LoongArch hosts.
Unusual KVM_SIGNAL_MSI or KVM_SET_GSI_ROUTING ioctl activity from processes that are not part of the trusted virtualization stack.
Kernel memory corruption artifacts adjacent to loongarch_eiointc allocations observed during post-mortem analysis.

Detection Strategies

Enable CONFIG_KASAN on test kernels to catch out-of-bounds writes in the EIOINTC bitmaps during fuzzing or regression testing.
Audit the running kernel version on LoongArch hosts and flag any builds that do not include commits 501514d or 83715a4.
Correlate /dev/kvm access with process identity to identify unprivileged callers issuing MSI-related ioctls.

Monitoring Recommendations

Ship kernel logs from LoongArch KVM hosts to a centralized data lake and alert on panics or bug reports naming EIOINTC symbols.
Monitor auditd rules on openat of /dev/kvm and on the KVM ioctl surface to baseline expected virtualization workflows.
Track process launches of qemu, libvirt, and other VMM components on LoongArch and alert on unknown binaries opening VM file descriptors.

How to Mitigate CVE-2026-89907

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 501514d6ebd2111c353a1296f25dbe22fbd64657 and 83715a40a2d30d23719e0b25380ba82ff905195b to all LoongArch KVM hosts.
Restrict /dev/kvm access to trusted users and service accounts using group ownership and permissions until patched kernels are deployed.
Inventory LoongArch systems running KVM workloads and prioritize patching hosts that expose VM creation to multi-tenant users.

Patch Information

The fix rejects MSI data that does not fit in the EIOINTC IRQ space before invoking eiointc_set_irq(). Upstream stable kernel commits are available at Kernel Git Commit 501514d and Kernel Git Commit 83715a4. Consume the patched kernel from your distribution vendor once available.

Workarounds

Disable KVM on LoongArch hosts that do not require virtualization until the patched kernel is installed.
Tighten permissions on /dev/kvm so that only vetted virtualization service accounts can open the device.
Avoid granting untrusted users the ability to create or configure VM interrupt routing on affected hosts.

bash

# Restrict /dev/kvm to the kvm group and remove world access
sudo chown root:kvm /dev/kvm
sudo chmod 0660 /dev/kvm

# Verify the running kernel includes the fix commits
uname -r
dmesg | grep -i eiointc