CVE-2026-89513

The Linux kernel's RISC-V KVM implementation mishandles the SBI PMU EVENT_GET_INFO request by storing a guest-controlled num_events multiplied by the entry size in a 32-bit integer. By supplying num_events = 0x10000001, a guest causes the computed size (0x100000010 bytes) to truncate to 16, so KVM allocates a single-entry array but then loops over the original num_events, producing out-of-bounds reads and writes in host kernel heap memory (demonstrated by a KASAN slab-out-of-bounds report triggered from a nested guest). Because the vulnerability corrupts kernel memory from inside a VM, a malicious or compromised guest on an affected RISC-V hypervisor could escape the VM and compromise the host kernel, consistent with the high CVSS 8.8 rating (confidentiality, integrity, and availability all high with scope change). Only systems running Linux as a RISC-V KVM host are affected; the flaw resides in the arch/riscv KVM PMU code path and requires a guest able to issue SBI PMU ecalls. No public proof of concept exists and the issue is not in the CISA KEV catalog, so exploitation in the wild is not currently known.

What to do: Apply kernel updates containing the upstream fix (which stores the shared-memory size in size_t, rejects multiplication overflow, and uses kvcalloc with GFP_KERNEL_ACCOUNT) to all RISC-V hosts running KVM. Until patched, restrict untrusted and nested guest workloads on RISC-V KVM hosts, since a nested guest was shown to trigger the out-of-bounds access. Monitor dmesg for KASAN slab-out-of-bounds reports in kvm_riscv_vcpu_pmu_event_info as an indicator of attempted exploitation.