CVE-2026-89904LoongArch: Fix acpi_package_ids[] array overflow
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix acpi_package_ids[] array overflow With LoongArch virt machine, a typical setting is one core per socket, there will max 256 sockets (packages) on one VM. With PPTT acpi table, array acpi_package_ids[] will be overflowed. Here change the array size of acpi_package_ids[] with the max value of MAX_PACKAGES and KVM_MAX_VCPUS.
- CVSS
- 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f18992be262d6515c94bf4bf6ce7598135076771 before 0195e04b1eec8fb00e2db9c5e55655a3f5e76f60; from 4427a33faabb4b81511b99dfee18ce0a38b5b5df before d3fd094c13c6d0b74f246461ca4cf427d539c8e8; from 4e8f58620f6717f72f3d88a2c8f25c0c656d0ba7 before 6311b8c471afa33c18adbe4eb16f862936b71ca3; 4e8f58620f6717f72f3d88a2c8f25c0c656d0ba7 builds before 2a2367d46d7a4ee4122b7a86e57125542dbbe963; 496bc868d9066e034787aa14b8ad6c23e77b51ef; from 6.12.101 before 6.12.110; from 6.18.42 before 6.18.51; from 7.1.6 before 7.2 | CNA record |
References
- https://git.kernel.org/stable/c/0195e04b1eec8fb00e2db9c5e55655a3f5e76f60
- https://git.kernel.org/stable/c/d3fd094c13c6d0b74f246461ca4cf427d539c8e8
- https://git.kernel.org/stable/c/6311b8c471afa33c18adbe4eb16f862936b71ca3
- https://git.kernel.org/stable/c/2a2367d46d7a4ee4122b7a86e57125542dbbe963
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.