Listen to this Post
How the CVE Works
This vulnerability exists within the KVM (Kernel Virtual Machine) subsystem for the LoongArch CPU architecture. The flaw occurs when modifying the EIOINTC_ENABLE register. A variable named ‘index’ is modified and then reused directly as an array index without proper bounds checking. This allows the ‘index’ value to overflow the bounds of the array it is accessing. An attacker with root privileges in a guest VM could exploit this to write kernel memory outside the intended array, potentially leading to a denial of service (crash) or privilege escalation on the host kernel.
DailyCVE Form
Platform: Linux Kernel
Version: LoongArch KVM
Vulnerability: Array Overflow
Severity: Medium
Date: 2025-07-25
Prediction: Patch expected by 2025-08-08
What Undercode Say:
Analytics
git log --oneline --grep="LoongArch: KVM: Avoid overflow with array index"
// Pseudo-code of the flaw index = some_calculation; index++; // Index is modified eiointc_enable_regs[bash] = value; // Potential overflow
How Exploit:
A malicious root user in a guest VM triggers specific KVM `ioctl` calls related to interrupt controller configuration, causing the host kernel to execute the flawed code path and corrupt kernel memory.
Protection from this CVE
Apply kernel patch.
Impact:
Denial of Service, Privilege Escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
