{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89513 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89513 is a high-severity vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89513 and fix it if it is affected.\n\nWhat it is: CVE-2026-89513 is a high-severity vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89513 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89513/ (Markdown: https://insights.sbomify.com/CVE-2026-89513/index.md)","id":"CVE-2026-89513","markdown":"https://insights.sbomify.com/CVE-2026-89513/index.md","name":"CVE-2026-89513","record":{"aliases":["BELL-CVE-2026-89513","DEBIAN-CVE-2026-89513","GHSA-8mvp-fqvr-fj7j","UBUNTU-CVE-2026-89513"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel KVM","requires_auth":"low_privilege","summary":"A guest VM can trigger an integer overflow in the RISC-V KVM PMU handler, leading to out-of-bounds memory access and potential code execution or system crash.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Fix PMU event info array size overflow\n\nSBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo)\nin a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010\ntruncate to 16. KVM then allocates one entry but loops over the original\nnum_events, causing out-of-bounds reads and writes. A nested guest\ntriggered:\n\nBUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info+0xa4/0x142\nRead of size 4 at addr ff600000074d46b0 by task init/1\nCall Trace:\n[\u003cffffffff8006471c\u003e] kvm_riscv_vcpu_pmu_event_info+0xa4/0x142\n[\u003cffffffff800690c0\u003e] kvm_sbi_ext_pmu_handler+0xca/0x268\n[\u003cffffffff8006779e\u003e] kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6\n[\u003cffffffff8006008c\u003e] kvm_riscv_vcpu_exit+0x48c/0x540\n[\u003cffffffff8005ea0a\u003e] kvm_arch_vcpu_ioctl_run+0x37e/0xc80\nAllocated by task 1:\n __kmalloc_noprof+0x19e/0x4b0\n kvm_riscv_vcpu_pmu_event_info+0x72/0x142\n kvm_sbi_ext_pmu_handler+0xca/0x268\n kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6\n kvm_riscv_vcpu_exit+0x48c/0x540\n kvm_arch_vcpu_ioctl_run+0x37e/0xc80\nThe buggy address is located 0 bytes to the right of\n allocated 16-byte region [ff600000074d46a0, ff600000074d46b0)\n\nStore the shared-memory size in size_t and reject multiplication overflow.\nAllocate the guest-driven array with GFP_KERNEL_ACCOUNT so it is charged\nto kmemcg, and use __GFP_NOWARN to suppress allocation failure warnings.\nUse kvcalloc() to allow vmalloc fallback and an unsigned long loop index\nto match num_events.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"RISC-V: KVM: Fix PMU event info array size overflow","id":"CVE-2026-89513","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock","id":"CVE-2026-89514"},"packages":[],"prev":{"headline":"remoteproc: scp: Fix device reference leak on failed lookup","id":"CVE-2026-89512"},"products":["Linux"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A guest VM can trigger an integer overflow in the RISC-V KVM PMU handler, leading to out-of-bounds memory access and potential code execution or system crash.","url":"https://insights.sbomify.com/CVE-2026-89513/"}