Answer in brief
CVE-2026-89513 records a High severity (CVSS 8.8) vulnerability in RISC-V: KVM: Fix PMU event info array size overflow. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=e309fd113b9f6c34672a487be08fecb7e12e7e29 <82088f88c96b99c27a974d09b02c2b133262fadf || >=e309fd113b9f6c34672a487be08fecb7e12e7e29 <735bc20c24187ca419c9d5e63860a54b91be34bd | 82088f88c96b99c27a974d09b02c2b133262fadf, 735bc20c24187ca419c9d5e63860a54b91be34bd |
| Linux/Linuxgeneric | 6.18 | Not reported |
| Linux/Linuxgeneric | >=e309fd113b9f6c34672a487be08fecb7e12e7e29 <ddbd71a3780942918a7d116d666313e5b3304d73 || >=e309fd113b9f6c34672a487be08fecb7e12e7e29 <82088f88c96b99c27a974d09b02c2b133262fadf || >=e309fd113b9f6c34672a487be08fecb7e12e7e29 <735bc20c24187ca419c9d5e63860a54b91be34bd | ddbd71a3780942918a7d116d666313e5b3304d73, 82088f88c96b99c27a974d09b02c2b133262fadf, 735bc20c24187ca419c9d5e63860a54b91be34bd |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo) in a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one entry but loops over the original num_events, causing out-of-bounds reads and writes. A nested guest triggered: BUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info+0xa4/0x142 Read of size 4 at addr ff600000074d46b0 by task init/1 Call Trace: [<ffffffff8006471c>] kvm_riscv_vcpu_pmu_event_info+0xa4/0x142 [<ffffffff800690c0>] kvm_sbi_ext_pmu_handler+0xca/0x268 [<ffffffff8006779e>] kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6 [<ffffffff8006008c>] kvm_riscv_vcpu_exit+0x48c/0x540 [<ffffffff8005ea0a>] kvm_arch_vcpu_ioctl_run+0x37e/0xc80 Allocated by task 1: __kmalloc_noprof+0x19e/0x4b0 kvm_riscv_vcpu_pmu_event_info+0x72/0x142 kvm_sbi_ext_pmu_handler+0xca/0x268 kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6 kvm_riscv_vcpu_exit+0x48c/0x540 kvm_arch_vcpu_ioctl_run+0x37e/0xc80 The buggy address is located 0 bytes to the right of allocated 16-byte region [ff600000074d46a0, ff600000074d46b0) Store the shared-memory size in size_t and reject multiplication overflow. Allocate the guest-driven array with GFP_KERNEL_ACCOUNT so it is charged to kmemcg, and use __GFP_NOWARN to suppress allocation failure warnings. Use kvcalloc() to allow vmalloc fallback and an unsigned long loop index to match num_events.
Quoted source text, attributed separately from HOL analysis.