CVE-2026-89907 LoongArch: KVM: Validate MSI data before routing it to EIOINTC

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pchmsisetirq passes e-msi.data straight into eiointcsetirq as the irq number. The MSI data comes from userspace, that either via a KVMIRQROUTINGMSI entry set with...

CVE-2026-89907 LoongArch: KVM: Validate MSI data before routing it to EIOINTC

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pchmsisetirq passes e-msi.data straight into eiointcsetirq as the irq number. The MSI data comes from userspace, that either via a KVMIRQROUTINGMSI entry set with...

CVE-2026-89907

CVE-2026-89907 affects the Linux kernel on the LoongArch architecture in the KVM EIOINTC MSI routing path. The function pch_msi_set_irq() passes user-supplied MSI data directly to eiointc_set_irq() without validating it against the 256-entry EIOINTC_IRQS limit. A value of 256 or greater causes ou...

EUVD-2026-80506

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmpoffset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under...

CVE-2026-89906

CVE-2026-89906 affects the LoongArch BPF JIT in the Linux kernel. The jump offset calculation for tail calls used a stale prior-pass code stride to derive branch distances, which can produce wrong branch offsets and cause soft lockups when extra JIT passes are triggered. The fix recalculates the ...

EUVD-2026-80507

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pchmsisetirq passes e-msi.data straight into eiointcsetirq as the irq number. The MSI data comes from userspace, that either via a KVMIRQROUTINGMSI entry set with...

CVE-2026-89906 LoongArch: BPF: Refactor jump offset calculation in tail call

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmpoffset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under...

EUVD-2026-80505

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Move arena register slot below TCC context Currently, the stack layout places the optional arena register slot above the tail call counter context. When arenavmstart is dynamically enabled, it shifts the relative...

CVE-2026-89905

CVE-2026-89905 affects the Linux kernel on the LoongArch architecture within the BPF subsystem. The root cause is a stack layout flaw : the optional arena register slot is placed above the tail call counter (TCC) context . When arena_vm_start is dynamically enabled, it shifts the relative offset ...

CVE-2026-89903 LoongArch: Do not save/restore percpu base register in rethook trampoline

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and restores it at exit. Inbetween rethooktrampolinehandler may schedule vi...

EUVD-2026-80503

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and restores it at exit. Inbetween rethooktrampolinehandler may schedule vi...

CVE-2026-89904 LoongArch: Fix acpi_package_ids[] array overflow

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix acpipackageids array overflow With LoongArch virt machine, a typical setting is one core per socket, there will max 256 sockets packages on one VM. With PPTT acpi table, array acpipackageids will be overflowed. Her...

CVE-2026-89903

CVE-2026-89903 affects the Linux kernel on the LoongArch architecture, specifically the rethook trampoline (previously the kretprobe trampoline since v6.3 ). The trampoline incorrectly saves and restores $r21 (the per-CPU base register) across its entry/exit frame. If a task migrates CPUs between...

CVE-2026-89903 LoongArch: Do not save/restore percpu base register in rethook trampoline

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and restores it at exit. Inbetween rethooktrampolinehandler may schedule vi...

EUVD-2026-80504

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix acpipackageids array overflow With LoongArch virt machine, a typical setting is one core per socket, there will max 256 sockets packages on one VM. With PPTT acpi table, array acpipackageids will be overflowed. Her...

CVE-2026-89904

This Linux kernel vulnerability affects the LoongArch architecture, where the acpi_package_ids[] array overflows when processing the PPTT ACPI table . In a typical LoongArch virtual machine configuration with one core per socket, up to 256 sockets (packages) can be present, exceeding the array's ...

CVE-2026-89902 LoongArch: Avoid preempt count underflow without probe

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, dobp can reach...

CVE-2026-89902

This Linux kernel vulnerability affects the LoongArch kprobe subsystem. Because LoongArch uses break 11 for kprobe breakpoints, an ordinary userspace breakpoint can reach kprobe_singlestep_handler() with no active probe. The handler calls preempt_enable_no_resched() before checking for a probe, c...

EUVD-2026-80502

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, dobp can reach...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fixed the jump offset calculation in tailcall. The additional call to bpfintjitcompile skips the JIT context initialization. This effectively skips the offset calculation, resulting in outoffset = -1. Therefore, t...