---
id: CVE-2026-89907
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  LoongArch: KVM: Validate MSI data before routing it to EIOINTC

  pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as
  the irq number
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  LoongArch: KVM: Validate MSI data before routing it to EIOINTC

  pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as
  the irq number. The MSI data com…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1928254c5ccb7bdffd7f0334e1ce250e9ce4de94 <
    83715a40a2d30d23719e0b25380ba82ff905195b
  - >-
    Linux >= 1928254c5ccb7bdffd7f0334e1ce250e9ce4de94 <
    501514d6ebd2111c353a1296f25dbe22fbd64657
  - Linux 6.13
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:16.810'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89907'
references:
  - url: 'https://git.kernel.org/stable/c/501514d6ebd2111c353a1296f25dbe22fbd64657'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/83715a40a2d30d23719e0b25380ba82ff905195b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.976Z'
epss: 0.00154
epssPercentile: 0.04933
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Validate MSI data before routing it to EIOINTC

pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as
the irq number. The MSI data comes from userspace, that either via a
KVM_IRQ_ROUTING_MSI entry set with KVM_SET_GSI_ROUTING (used by irqfd
and KVM_IRQ_LINE) or directly via KVM_SIGNAL_MSI, and is never checked
against EIOINTC_IRQS.

eiointc_set_irq() uses the value with __set_bit()/__clear_bit() on the
256-bit isr bitmap, eiointc_update_irq() then indexes sw_coremap[] and
the per-cpu coreisr/sw_coreisr bitmaps with it. Therefore a data value
>= 256 reads and writes memory past the end of those arrays, i.e. any
process holding a VM fd can corrupt kernel memory beyond the allocation
of loongarch_eiointc.

Reject MSI data that doesn't fit in the EIOINTC irq space. The DMSINTC
path is unaffected as it decodes the vector from the address and masks
it.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.