{"id":"CVE-2026-89910","state":"PUBLISHED","title":"LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Fix uninitialized stack variable issue with dmsintc\n\nVariable vector[] is declared on stack in function dmsintc_inject_irq()\nand sometimes it is used without initialized. Here fix this issue.","publishedAt":"2026-09-16T10:32:07.951Z","updatedAt":"2026-10-19T08:54:43.786Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"03de5eecb0f0f68f29086bc0075c7fd597bf4e4a","status":"affected","lessThan":"f56060b0e10fa5633fac1dc243a25da3a5cdafb1","versionType":"git"},{"version":"03de5eecb0f0f68f29086bc0075c7fd597bf4e4a","status":"affected","lessThan":"81aa3a58b542ed88819115c80a17acd86eacb89d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/loongarch/kvm/intc/dmsintc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.1","versionType":"semver"},{"version":"7.2.5","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/loongarch/kvm/intc/dmsintc.c"]}],"references":["https://git.kernel.org/stable/c/f56060b0e10fa5633fac1dc243a25da3a5cdafb1","https://git.kernel.org/stable/c/81aa3a58b542ed88819115c80a17acd86eacb89d"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89910.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89910","state":"PUBLISHED","datePublished":"2026-09-16T10:32:07.951Z","dateUpdated":"2026-10-19T08:54:43.786Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.774Z"},"containers":{"cna":{"title":"LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Fix uninitialized stack variable issue with dmsintc\n\nVariable vector[] is declared on stack in function dmsintc_inject_irq()\nand sometimes it is used without initialized. Here fix this issue."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"03de5eecb0f0f68f29086bc0075c7fd597bf4e4a","status":"affected","lessThan":"f56060b0e10fa5633fac1dc243a25da3a5cdafb1","versionType":"git"},{"version":"03de5eecb0f0f68f29086bc0075c7fd597bf4e4a","status":"affected","lessThan":"81aa3a58b542ed88819115c80a17acd86eacb89d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/loongarch/kvm/intc/dmsintc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.1","versionType":"semver"},{"version":"7.2.5","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/loongarch/kvm/intc/dmsintc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f56060b0e10fa5633fac1dc243a25da3a5cdafb1"},{"url":"https://git.kernel.org/stable/c/81aa3a58b542ed88819115c80a17acd86eacb89d"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The uninitialized vector[] is used in dmsintc_inject_irq(), called from kvm_deliver_intr() on KVM_RUN (kvm_pre_enter_guest) and KVM_GET_ONE_REG ESTAT after irqfd/KVM_SIGNAL_MSI or KVM_INTERRUPT queues INT_AVEC. That is a local /dev/kvm and guest MSI path, not a network or physical protocol handler.\nAC:L - A kvm-group VMM can create a MSGINT vCPU, queue INT_AVEC via KVM_INTERRUPT or irqfd MSI, then KVM_RUN or GET_ONE_REG ESTAT; any zero vector_map word leaves the matching stack slot uninitialized and typically nonzero. A guest retriggers the same inject on ordinary virtio/MSI I/O with no race.\nPR:L - kvm_dev_ioctl_create_vm() has no capable() check, so kvm-group (or equivalent) access is enough to create dmsintc, enable CPUCFG MSGINT, and inject AVEC. A LoongArch KVM tenant can also cause irqfd MSI injection and read guest ISR CSRs, which is Low privilege relative to the hypervisor, not init-namespace root.\nUI:N - The attacker issues KVM ioctls or guest device I/O themselves; no separate victim action such as mounting a filesystem or opening a file is required.\nS:C - dmsintc_inject_irq() writes host kernel stack contents into hardware guest ISR CSRs (LOONGARCH_CSR_ISR0-3) that the guest can read with csrrd and that the VMM can read after vcpu_put. That discloses hypervisor memory across the KVM guest-to-host boundary.\nC:H - Up to four uninitialized unsigned long stack slots are OR'd into guest-visible ISR registers on every AVEC injection. Repeated MSI or KVM_RUN samples resample kernel stack including pointers, matching CNA stack-leak scoring for KASLR defeat.\nI:L - The same uninitialized words are OR'd into guest ISR0-3, setting extra AVEC pending bits the VMM did not inject. That is limited corruption of guest interrupt-controller state, not an arbitrary host write or control-flow hijack.\nA:N - The uninitialized values are consumed only as ISR bitmasks via gcsr_write; they are not used as pointers and do not oops, panic, hang, or otherwise deny host service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T08:54:43.786Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}