{"id":21435,"date":"2026-09-12T04:31:11","date_gmt":"2026-09-11T20:31:11","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89513"},"modified":"2026-09-12T04:31:11","modified_gmt":"2026-09-11T20:31:11","slug":"cve-2026-89513","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89513","title":{"rendered":"CVE-2026-89513 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Fix PMU"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>RISC-V: KVM: Fix PMU event info array size overflow<\/p>\n<p>SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo)<br \/>\nin a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010<br \/>\ntruncate to 16. KVM then allocates one entry but loops over the original<br \/>\nnum_events, causing out-of-bounds reads and writes. A nested guest<br \/>\ntriggered:<\/p>\n<p>BUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info+0xa4\/0x142<br \/>\nRead of size 4 at addr ff600000074d46b0 by task init\/1<br \/>\nCall Trace:<br \/>\n[] kvm_riscv_vcpu_pmu_event_info+0xa4\/0x142<br \/>\n[] kvm_sbi_ext_pmu_handler+0xca\/0x268<br \/>\n[] kvm_riscv_vcpu_sbi_ecall+0xec\/0x1e6<br \/>\n[] kvm_riscv_vcpu_exit+0x48c\/0x540<br \/>\n[] kvm_arch_vcpu_ioctl_run+0x37e\/0xc80<br \/>\nAllocated by task 1:<br \/>\n __kmalloc_noprof+0x19e\/0x4b0<br \/>\n kvm_riscv_vcpu_pmu_event_info+0x72\/0x142<br \/>\n kvm_sbi_ext_pmu_handler+0xca\/0x268<br \/>\n kvm_riscv_vcpu_sbi_ecall+0xec\/0x1e6<br \/>\n kvm_riscv_vcpu_exit+0x48c\/0x540<br \/>\n kvm_arch_vcpu_ioctl_run+0x37e\/0xc80<br \/>\nThe buggy address is located 0 bytes to the right of<br \/>\n allocated 16-byte region [ff600000074d46a0, ff600000074d46b0)<\/p>\n<p>Store the shared-memory size in size_t and reject multiplication overflow.<br \/>\nAllocate the guest-driven array with GFP_KERNEL_ACCOUNT so it is charged<br \/>\nto kmemcg, and use __GFP_NOWARN to suppress allocation failure warnings.<br \/>\nUse kvcalloc() to allow vmalloc fallback and an unsigned long loop index<br \/>\nto match num_events.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>RISC-V: KVM: Fix PMU event info array size overflow<\/p>\n<p>SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo)<br \/>\nin <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21435","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21435","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21435"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21435"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21435"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}