CVE-2026-89910: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89910 Overview

CVE-2026-89910 is a high-severity vulnerability in the Linux kernel's LoongArch Kernel-based Virtual Machine (KVM) subsystem. The flaw resides in the dmsintc_inject_irq() function, where the stack-allocated vector[] array is used before initialization. This uninitialized memory use can leak host kernel stack data into virtualized interrupt handling paths and destabilize guest interrupt delivery. The vulnerability requires local access with low privileges and does not require user interaction. Because the scope is changed, exploitation can affect resources beyond the initially vulnerable component, including guest virtual machines running under KVM on LoongArch hosts.

Critical Impact
A local attacker with low privileges on a LoongArch host running KVM can exploit uninitialized stack memory in dmsintc_inject_irq() to disclose sensitive kernel information across a virtualization boundary.

Affected Products

Linux kernel builds for the LoongArch architecture with KVM enabled
Linux kernel versions containing the dmsintc interrupt controller injection path prior to the fix commits
Distributions shipping affected upstream Linux kernels on LoongArch platforms

Discovery Timeline

2026-09-16 - CVE-2026-89910 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89910

Vulnerability Analysis

The vulnerability is an Uninitialized Memory Use issue [CWE-908] in the LoongArch KVM interrupt injection path. The dmsintc_inject_irq() function declares a vector[] array on the stack and, under some code paths, reads from that array before its contents are assigned. Stack memory in the Linux kernel is not zeroed on allocation, so the array holds residual data from prior function frames. When the interrupt controller logic consumes these values to compute or route a virtual interrupt to a guest, undefined behavior follows. The reachable impact spans information disclosure of host kernel stack contents and incorrect interrupt targeting inside virtual machines. Because KVM crosses the trust boundary between host and guest, the CVSS scope is marked as changed. The upstream fix initializes vector[] before use, closing the read-before-write window.

Root Cause

The root cause is a missing initialization of a local automatic variable. The vector[] array in dmsintc_inject_irq() was declared without an initializer, and control flow allowed reads before every element was assigned. The kernel does not implicitly zero stack allocations unless built with CONFIG_INIT_STACK_ALL_ZERO or similar options, so the array reflected leftover kernel stack data.

Attack Vector

An attacker with local, low-privileged access to a LoongArch host running KVM can trigger the vulnerable interrupt injection path from a guest VM or from a host-side process that interacts with the KVM ioctl interface. Repeated invocation can be used to sample host stack contents or influence interrupt delivery. Network access is not required, and the attack complexity is low.

No public proof-of-concept code is available. The vulnerability mechanism is documented in the upstream commits 81aa3a58b542 and f56060b0e10f.

Detection Methods for CVE-2026-89910

Indicators of Compromise

Unexpected kernel warnings or KASAN reports referencing dmsintc_inject_irq in host dmesg output on LoongArch systems.
Anomalous virtual interrupt behavior inside guest VMs, including spurious or misrouted IRQs originating from the LoongArch dmsintc controller.
Guest processes on LoongArch hosts issuing repeated KVM interrupt-related ioctls without a legitimate workload pattern.

Detection Strategies

Enable kernel hardening options such as CONFIG_INIT_STACK_ALL_ZERO and KASAN on test kernels to surface uninitialized reads in the KVM code path.
Audit the running kernel version and configuration on LoongArch hosts against the fix commits 81aa3a58b542 and f56060b0e10f to confirm patched builds.
Correlate host dmesg anomalies with guest interrupt failures using a centralized log platform to identify possible exploitation attempts.

Monitoring Recommendations

Ingest host kernel logs and KVM tracepoints into a centralized data lake and alert on dmsintc warnings or KVM error signatures.
Monitor for unauthorized users or processes on LoongArch hosts opening /dev/kvm outside of expected virtualization workloads.
Track kernel package versions across the LoongArch fleet and alert when hosts run unpatched builds.

How to Mitigate CVE-2026-89910

Immediate Actions Required

Inventory all LoongArch hosts running KVM and identify kernels that do not include the upstream fix commits.
Apply the patched kernel from your distribution vendor or rebuild from a stable branch that contains commits 81aa3a58b542 and f56060b0e10f.
Restrict access to /dev/kvm and KVM management interfaces to trusted virtualization service accounts only.

Patch Information

The issue is resolved upstream by initializing the vector[] stack variable in dmsintc_inject_irq() before use. Refer to the fix commits 81aa3a58b542 and f56060b0e10f on kernel.org. Downstream distributions shipping LoongArch kernels should backport these commits or upgrade to a stable release that includes them.

Workarounds

Disable KVM on LoongArch hosts that do not require virtualization by removing the kvm module until a patched kernel is deployed.
Rebuild the kernel with CONFIG_INIT_STACK_ALL_ZERO=y to force zero-initialization of stack allocations as a defense-in-depth measure.
Limit guest VM creation and KVM ioctl access to a minimal set of privileged administrators pending patch deployment.

bash

# Verify running kernel and confirm the fix is present
uname -r
zcat /proc/config.gz | grep -E 'CONFIG_KVM|CONFIG_INIT_STACK_ALL_ZERO'

# Temporarily unload the KVM module on affected LoongArch hosts
sudo modprobe -r kvm

# Restrict /dev/kvm access to a dedicated group
sudo chgrp kvm /dev/kvm
sudo chmod 0660 /dev/kvm