CVE-2026-89513

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) component for RISC-V architectures. A malicious guest operating system could exploit an integer overflow vulnerability by providing a crafted number of Performance Monitoring Unit (PMU) events during the SBI PMU EVENT_GET_INFO call. This leads to KVM allocating insufficient memory, resulting in out-of-bounds reads and writes. This memory corruption could allow a malicious guest to cause a denial of service (DoS) or potentially escalate privileges on the host system.

This vulnerability is evaluated as Important because a malicious guest environment can cause host memory corruption, potentially breaking hypervisor isolation to gain elevated privileges or trigger host denial of service. The underlying issue is specific to KVM support on the RISC-V hardware platform. Red Hat products do not support the RISC-V architecture and do not ship the affected code, meaning Red Hat enterprise distributions are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.