---
id: CVE-2026-89904
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  LoongArch: Fix acpi_package_ids[] array overflow

  With LoongArch virt machine, a typical setting is one core per socket,
  there will max 256 sockets (packages) on one VM…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  LoongArch: Fix acpi_package_ids[] array overflow

  With LoongArch virt machine, a typical setting is one core per socket,
  there will max 256 sockets (packages) on one VM…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f18992be262d6515c94bf4bf6ce7598135076771 <
    0195e04b1eec8fb00e2db9c5e55655a3f5e76f60
  - >-
    Linux >= 4427a33faabb4b81511b99dfee18ce0a38b5b5df <
    d3fd094c13c6d0b74f246461ca4cf427d539c8e8
  - >-
    Linux >= 4e8f58620f6717f72f3d88a2c8f25c0c656d0ba7 <
    6311b8c471afa33c18adbe4eb16f862936b71ca3
  - >-
    Linux >= 4e8f58620f6717f72f3d88a2c8f25c0c656d0ba7 <
    2a2367d46d7a4ee4122b7a86e57125542dbbe963
  - Linux 496bc868d9066e034787aa14b8ad6c23e77b51ef
  - Linux >= 6.12.101 < 6.12.110
  - Linux >= 6.18.42 < 6.18.51
  - Linux >= 7.1.6 < 7.2
  - Linux 7.2
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:16.567'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89904'
references:
  - url: 'https://git.kernel.org/stable/c/0195e04b1eec8fb00e2db9c5e55655a3f5e76f60'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2a2367d46d7a4ee4122b7a86e57125542dbbe963'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6311b8c471afa33c18adbe4eb16f862936b71ca3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d3fd094c13c6d0b74f246461ca4cf427d539c8e8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.977Z'
epss: 0.0018
epssPercentile: 0.07842
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Fix acpi_package_ids[] array overflow

With LoongArch virt machine, a typical setting is one core per socket,
there will max 256 sockets (packages) on one VM. With PPTT acpi table,
array acpi_package_ids[] will be overflowed.

Here change the array size of acpi_package_ids[] with the max value of
MAX_PACKAGES and KVM_MAX_VCPUS.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.