CVE-2026-72295 (GCVE-0-2026-72295)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42
VLAI
Title
LoongArch: KVM: Validate irqchip index in irqfd routing
Summary
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate irqchip index in irqfd routing Sashiko reported that the irqchip index is not validated for LoongArch. Add validation and reject out-of-range irqchip indexes to avoid indexing past the routing table's chip array.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1928254c5ccb7bdffd7f0334e1ce250e9ce4de94 , < 199b570d7fca1aa70e596f10a6276997becffb6d (git)
Affected: 1928254c5ccb7bdffd7f0334e1ce250e9ce4de94 , < 8b3e188d19e4ffe916780aeb7ddad9d6457b8bcc (git)
Affected: 1928254c5ccb7bdffd7f0334e1ce250e9ce4de94 , < 3474037904c20ff915e3ebab0ab5c1e41bbe549e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/kvm/irqfd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "199b570d7fca1aa70e596f10a6276997becffb6d",
              "status": "affected",
              "version": "1928254c5ccb7bdffd7f0334e1ce250e9ce4de94",
              "versionType": "git"
            },
            {
              "lessThan": "8b3e188d19e4ffe916780aeb7ddad9d6457b8bcc",
              "status": "affected",
              "version": "1928254c5ccb7bdffd7f0334e1ce250e9ce4de94",
              "versionType": "git"
            },
            {
              "lessThan": "3474037904c20ff915e3ebab0ab5c1e41bbe549e",
              "status": "affected",
              "version": "1928254c5ccb7bdffd7f0334e1ce250e9ce4de94",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/kvm/irqfd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Validate irqchip index in irqfd routing\n\nSashiko reported that the irqchip index is not validated for LoongArch.\nAdd validation and reject out-of-range irqchip indexes to avoid indexing\npast the routing table\u0027s chip array."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The out-of-bounds write is reached only via local KVM ioctls on /dev/kvm (KVM_CREATE_VM \u2192 KVM_SET_GSI_ROUTING with KVM_IRQ_ROUTING_IRQCHIP); no network, Bluetooth, or physical device path reaches kvm_set_routing_entry().\nAC:L - One KVM_SET_GSI_ROUTING call with irqchip\u003e=KVM_NR_IRQCHIPS (valid pin/gsi) deterministically executes rt-\u003echip[irqchip][pin]=gsi past the chip[] boundary; the attacker fully controls irqchip, pin, and gsi with no race or uncontrollable layout.\nPR:L - Exploitation requires only opening /dev/kvm and holding a VM fd (kvm group membership or CAP_SYS_ADMIN obtainable in a user namespace), matching unprivileged cloud tenants or QEMU service accounts\u2014not init-namespace root.\nUI:N - No victim interaction is needed beyond the attacker\u0027s own KVM setup; a single malicious KVM_SET_GSI_ROUTING ioctl on a VM they control triggers the corruption.\nS:C - A KVM VM operator corrupts host kernel heap memory in the per-VM irq routing table from the KVM userspace interface, crossing the VM-to-host virtualization boundary rather than confining impact to the attacker\u0027s VM scope.\nC:H - Unvalidated irqchip indexes cause out-of-bounds writes past chip[] into nr_rt_entries and map[] hlist metadata in a kmalloc\u0027d routing table; per kernel guidance such heap corruption is leverageable for host kernel memory disclosure.\nI:H - The attacker controls both the OOB index (irqchip,pin) and written value (gsi), yielding targeted corruption of routing-table pointers/state that can be steered toward host privilege escalation or code execution.\nA:H - Corrupting nr_rt_entries or map[] entries breaks subsequent irqfd/GSI routing lookups and irq injection, causing host kernel oops/panic or persistent VM/host denial of service on LoongArch KVM hosts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:28.074Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/199b570d7fca1aa70e596f10a6276997becffb6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b3e188d19e4ffe916780aeb7ddad9d6457b8bcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/3474037904c20ff915e3ebab0ab5c1e41bbe549e"
        }
      ],
      "title": "LoongArch: KVM: Validate irqchip index in irqfd routing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72295",
    "datePublished": "2026-08-15T05:55:16.590Z",
    "dateReserved": "2026-08-09T03:40:39.917Z",
    "dateUpdated": "2026-08-17T05:42:28.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72295",
      "date": "2026-09-21",
      "epss": "0.00162",
      "percentile": "0.0578"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/loongarch/kvm/irqfd.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "199b570d7fca1aa70e596f10a6276997becffb6d",
                    "status": "affected",
                    "version": "1928254c5ccb7bdffd7f0334e1ce250e9ce4de94",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8b3e188d19e4ffe916780aeb7ddad9d6457b8bcc",
                    "status": "affected",
                    "version": "1928254c5ccb7bdffd7f0334e1ce250e9ce4de94",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3474037904c20ff915e3ebab0ab5c1e41bbe549e",
                    "status": "affected",
                    "version": "1928254c5ccb7bdffd7f0334e1ce250e9ce4de94",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/loongarch/kvm/irqfd.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.13"
                  },
                  {
                    "lessThan": "6.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Validate irqchip index in irqfd routing\n\nSashiko reported that the irqchip index is not validated for LoongArch.\nAdd validation and reject out-of-range irqchip indexes to avoid indexing\npast the routing table\u0027s chip array."
          }
        ],
        "id": "CVE-2026-72295",
        "lastModified": "2026-08-17T06:18:32.310",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:02.037",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/199b570d7fca1aa70e596f10a6276997becffb6d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3474037904c20ff915e3ebab0ab5c1e41bbe549e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8b3e188d19e4ffe916780aeb7ddad9d6457b8bcc"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T09:53:39+00:00",
      "cve": "CVE-2026-72295",
      "id": "CVE-2026-72295",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: LoongArch: KVM: Validate irqchip index in irqfd routing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72295.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-01T13:30:44Z",
      "cve": "CVE-2026-72295",
      "id": "CVE-2026-72295",
      "initial_release_date": "2026-09-01T13:30:44Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72295",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72295.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.