CVE-2026-89904

LoongArch: Fix acpi_package_ids[] array overflow

State: Published
Severity: 8.4 High
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Fix acpi_package_ids[] array overflow

With LoongArch virt machine, a typical setting is one core per socket, there will max 256 sockets (packages) on one VM. With PPTT acpi table, array acpi_package_ids[] will be overflowed.

Here change the array size of acpi_package_ids[] with the max value of MAX_PACKAGES and KVM_MAX_VCPUS.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f18992be262d6515c94bf4bf6ce7598135076771 to before 0195e04b1eec8fb00e2db9c5e55655a3f5e76f60Affected 4427a33faabb4b81511b99dfee18ce0a38b5b5df to before d3fd094c13c6d0b74f246461ca4cf427d539c8e8Affected 4e8f58620f6717f72f3d88a2c8f25c0c656d0ba7 to before 6311b8c471afa33c18adbe4eb16f862936b71ca3Affected 4e8f58620f6717f72f3d88a2c8f25c0c656d0ba7 to before 2a2367d46d7a4ee4122b7a86e57125542dbbe963Affected 496bc868d9066e034787aa14b8ad6c23e77b51efAffected 6.12.101 to before 6.12.110Affected 6.18.42 to before 6.18.51Affected 7.1.6 to before 7.2Affected
LinuxLinux	7.2Affected before 7.2Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

f18992be262d6515c94bf4bf6ce7598135076771 to before 0195e04b1eec8fb00e2db9c5e55655a3f5e76f60Affected
4427a33faabb4b81511b99dfee18ce0a38b5b5df to before d3fd094c13c6d0b74f246461ca4cf427d539c8e8Affected
4e8f58620f6717f72f3d88a2c8f25c0c656d0ba7 to before 6311b8c471afa33c18adbe4eb16f862936b71ca3Affected
4e8f58620f6717f72f3d88a2c8f25c0c656d0ba7 to before 2a2367d46d7a4ee4122b7a86e57125542dbbe963Affected
496bc868d9066e034787aa14b8ad6c23e77b51efAffected
6.12.101 to before 6.12.110Affected
6.18.42 to before 6.18.51Affected
7.1.6 to before 7.2Affected

LinuxLinux

7.2Affected
before 7.2Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.