The vulnerability CVE-2026-89513 in the Linux kernel affects the RISC-V KVM PMU event info handling. Specifically, the SBI PMU EVENT_GET_INFO call stores the guest-controlled number of events multiplied by the event info size in a 32-bit integer, which truncates on 64-bit RISC-V (RV64) when num_events is large (e.g., 0x10000001). This causes KVM to allocate memory for only one entry but loop over the original large num_events, resulting in out-of-bounds memory reads and writes. The issue was detected by KASAN during nested guest execution. The patch corrected this by storing the size in size_t, rejecting multiplication overflow, allocating memory with GFP_KERNEL_ACCOUNT, suppressing allocation warnings, and using kvcalloc() for safer allocation with vmalloc fallback.

This vulnerability allows out-of-bounds memory access in the Linux kernel's RISC-V KVM subsystem, which can lead to memory corruption and potential instability or escalation of privileges within nested virtual machines. The flaw is triggered by a malicious or malformed nested guest that controls the number of PMU events, causing KVM to read and write beyond allocated memory boundaries.

A fix is available that addresses the overflow and memory allocation issues by using appropriate size types and safer allocation functions. Users should apply the official Linux kernel patches that resolve CVE-2026-89513. No additional mitigation is required once the patch is applied.