CVE-2026-72294 (GCVE-0-2026-72294)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42
VLAI
Title
LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()
Summary
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() Function kvm_vcpu_ioctl_interrupt() can be called from userspace, here add irq validility cheking in kvm_vcpu_ioctl_interrupt().
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f45ad5b8aa9335bc6b30331b739e778f2f730b35 , < 15469ba0284c7cc01c38493391e9e73b918833c4 (git)
Affected: f45ad5b8aa9335bc6b30331b739e778f2f730b35 , < efe27b19a15c384cad7c80de399f3107ab070e6d (git)
Affected: f45ad5b8aa9335bc6b30331b739e778f2f730b35 , < d4574547e04a47ad498149576f65b84475ea6f4c (git)
Affected: f45ad5b8aa9335bc6b30331b739e778f2f730b35 , < 09b318ab77b7a4fc9987fd98d1525fc55ddc2617 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/kvm/vcpu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "15469ba0284c7cc01c38493391e9e73b918833c4",
              "status": "affected",
              "version": "f45ad5b8aa9335bc6b30331b739e778f2f730b35",
              "versionType": "git"
            },
            {
              "lessThan": "efe27b19a15c384cad7c80de399f3107ab070e6d",
              "status": "affected",
              "version": "f45ad5b8aa9335bc6b30331b739e778f2f730b35",
              "versionType": "git"
            },
            {
              "lessThan": "d4574547e04a47ad498149576f65b84475ea6f4c",
              "status": "affected",
              "version": "f45ad5b8aa9335bc6b30331b739e778f2f730b35",
              "versionType": "git"
            },
            {
              "lessThan": "09b318ab77b7a4fc9987fd98d1525fc55ddc2617",
              "status": "affected",
              "version": "f45ad5b8aa9335bc6b30331b739e778f2f730b35",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/kvm/vcpu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()\n\nFunction kvm_vcpu_ioctl_interrupt() can be called from userspace, here\nadd irq validility cheking in kvm_vcpu_ioctl_interrupt()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only through local KVM ioctls on /dev/kvm (KVM_CREATE_VM, KVM_CREATE_VCPU, KVM_INTERRUPT on the vCPU fd); kvm_arch_vcpu_unlocked_ioctl() passes attacker-controlled irq values into kvm_vcpu_ioctl_interrupt() with no network, adjacent, or physical entry path.\nAC:L - One KVM_INTERRUPT ioctl with irq \u003e= 15 or irq=0x80000000 deterministically calls kvm_queue_irq()/kvm_dequeue_irq(), which invoke set_bit()/clear_bit() far past the 15-bit irq_pending/irq_clear fields; no race, timing window, or attacker-uncontrollable memory layout is required.\nPR:L - Exploitation needs only permission to open /dev/kvm and manage a VM/vCPU (commonly kvm group membership or CAP_SYS_ADMIN obtainable inside a user namespace); it does not require init-namespace root or capabilities unavailable to an unprivileged local tenant.\nUI:N - No victim or operator interaction beyond the attacker\u0027s own KVM setup is required; once /dev/kvm access exists, a single malicious KVM_INTERRUPT ioctl on a controlled vCPU fd triggers the out-of-bounds bit manipulation.\nS:C - A KVM VM operator can corrupt host kernel memory in kvm_vcpu_arch from the KVM userspace interface, crossing the guest/VM-to-host virtualization boundary rather than confining impact to the attacker\u0027s own VM security scope.\nC:H - Unvalidated irq indices make set_bit()/clear_bit() operate many words beyond irq_pending/irq_clear, corrupting adjacent host vcpu-\u003earch fields and potentially neighboring slab objects; per kernel guidance this out-of-bounds memory corruption is leverageable for host kernel information disclosure.\nI:H - The attacker fully controls the bit index via the irq argument, yielding controlled out-of-bounds set_bit()/clear_bit() writes across the vCPU kmem_cache allocation that can be steered toward host kernel privilege escalation or code execution.\nA:H - Corrupting irq_pending-adjacent kvm_vcpu_arch state or memory beyond the vCPU object can immediately oops or panic the host kernel when the vCPU runs or on subsequent KVM operations, constituting high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:26.951Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/15469ba0284c7cc01c38493391e9e73b918833c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/efe27b19a15c384cad7c80de399f3107ab070e6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4574547e04a47ad498149576f65b84475ea6f4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/09b318ab77b7a4fc9987fd98d1525fc55ddc2617"
        }
      ],
      "title": "LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72294",
    "datePublished": "2026-08-15T05:55:14.553Z",
    "dateReserved": "2026-08-09T03:40:39.917Z",
    "dateUpdated": "2026-08-17T05:42:26.951Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72294",
      "date": "2026-09-21",
      "epss": "0.00163",
      "percentile": "0.05962"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/loongarch/kvm/vcpu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "15469ba0284c7cc01c38493391e9e73b918833c4",
                    "status": "affected",
                    "version": "f45ad5b8aa9335bc6b30331b739e778f2f730b35",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "efe27b19a15c384cad7c80de399f3107ab070e6d",
                    "status": "affected",
                    "version": "f45ad5b8aa9335bc6b30331b739e778f2f730b35",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d4574547e04a47ad498149576f65b84475ea6f4c",
                    "status": "affected",
                    "version": "f45ad5b8aa9335bc6b30331b739e778f2f730b35",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "09b318ab77b7a4fc9987fd98d1525fc55ddc2617",
                    "status": "affected",
                    "version": "f45ad5b8aa9335bc6b30331b739e778f2f730b35",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/loongarch/kvm/vcpu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()\n\nFunction kvm_vcpu_ioctl_interrupt() can be called from userspace, here\nadd irq validility cheking in kvm_vcpu_ioctl_interrupt()."
          }
        ],
        "id": "CVE-2026-72294",
        "lastModified": "2026-08-17T06:18:32.193",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:01.783",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/09b318ab77b7a4fc9987fd98d1525fc55ddc2617"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/15469ba0284c7cc01c38493391e9e73b918833c4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d4574547e04a47ad498149576f65b84475ea6f4c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/efe27b19a15c384cad7c80de399f3107ab070e6d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T15:52:41+00:00",
      "cve": "CVE-2026-72294",
      "id": "CVE-2026-72294",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72294.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T13:30:45Z",
      "cve": "CVE-2026-72294",
      "id": "CVE-2026-72294",
      "initial_release_date": "2026-09-01T13:30:45Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72294",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72294.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.