CVE-2026-89513

In the Linux kernel, the following vulnerability has been resolved:

RISC-V: KVM: Fix PMU event info array size overflow

SBI PMU EVENT GET INFO stores guest-controlled num events * sizeof(*einfo) in a 32-bit integer. On RV64, num events = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one entry but loops over the original num events, causing out-of-bounds reads and writes. A nested guest triggered:

BUG: KASAN: slab-out-of-bounds in kvm riscv vcpu pmu event info+0xa4/0x142 Read of size 4 at addr ff600000074d46b0 by task init/1 Call Trace: [] kvm riscv vcpu pmu event info+0xa4/0x142 [] kvm sbi ext pmu handler+0xca/0x268 [] kvm riscv vcpu sbi ecall+0xec/0x1e6 [] kvm riscv vcpu exit+0x48c/0x540 [] kvm arch vcpu ioctl run+0x37e/0xc80 Allocated by task 1: kmalloc noprof+0x19e/0x4b0 kvm riscv vcpu pmu event info+0x72/0x142 kvm sbi ext pmu handler+0xca/0x268 kvm riscv vcpu sbi ecall+0xec/0x1e6 kvm riscv vcpu exit+0x48c/0x540 kvm arch vcpu ioctl run+0x37e/0xc80 The buggy address is located 0 bytes to the right of allocated 16-byte region [ff600000074d46a0, ff600000074d46b0)

Store the shared-memory size in size t and reject multiplication overflow. Allocate the guest-driven array with GFP KERNEL ACCOUNT so it is charged to kmemcg, and use GFP NOWARN to suppress allocation failure warnings. Use kvcalloc() to allow vmalloc fallback and an unsigned long loop index to match num events.