{
  "cveId": "CVE-2026-89513",
  "url": "https://patchblox.com/security/cve/CVE-2026-89513",
  "summary": "CVE-2026-89513 is fixed in linux on 1 platform by DEBIAN-CVE-2026-89513 (version 7.2.6-1), released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  RISC-V: KVM: Fix PMU event info array size overf...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  RISC-V: KVM: Fix PMU event info array size overflow  SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo) in a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one entry but loops over the original num_events, causing out-of-bounds reads and writes. A nested guest triggered:  BUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info\u002B0xa4/0x142 Read of size 4 at addr ff600000074d46b0 by task init/1 Call Trace: [\u003Cffffffff8006471c\u003E] kvm_riscv_vcpu_pmu_event_info\u002B0xa4/0x142 [\u003Cffffffff800690c0\u003E] kvm_sbi_ext_pmu_handler\u002B0xca/0x268 [\u003Cffffffff8006779e\u003E] kvm_riscv_vcpu_sbi_ecall\u002B0xec/0x1e6 [\u003Cffffffff8006008c\u003E] kvm_riscv_vcpu_exit\u002B0x48c/0x540 [\u003Cffffffff8005ea0a\u003E] kvm_arch_vcpu_ioctl_run\u002B0x37e/0xc80 Allocated by task 1:  __kmalloc_noprof\u002B0x19e/0x4b0  kvm_riscv_vcpu_pmu_event_info\u002B0x72/0x142  kvm_sbi_ext_pmu_handler\u002B0xca/0x268  kvm_riscv_vcpu_sbi_ecall\u002B0xec/0x1e6  kvm_riscv_vcpu_exit\u002B0x48c/0x540  kvm_arch_vcpu_ioctl_run\u002B0x37e/0xc80 The buggy address is located 0 bytes to the right of  allocated 16-byte region [ff600000074d46a0, ff600000074d46b0)  Store the shared-memory size in size_t and reject multiplication overflow. Allocate the guest-driven array with GFP_KERNEL_ACCOUNT so it is charged to kmemcg, and use __GFP_NOWARN to suppress allocation failure warnings. Use kvcalloc() to allow vmalloc fallback and an unsigned long loop index to match num_events.",
  "published": "2026-09-11T20:19:33Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss": 0.00173,
  "epssPercentile": 0.06795,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-89513",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-89513",
      "released": "2026-09-23T19:19:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}