A critical kernel memory corruption vulnerability in the Linux LoongArch KVM subsystem allows local, authenticated users to achieve arbitrary memory corruption and potential code execution.

This vulnerability arises from insufficient validation of MSI data in the LoongArch KVM module, where user provided data is used as an index for bit operations without bounds checking. An attacker with local access and the ability to open a virtual machine file descriptor can trigger an out of bounds write to kernel memory.

Successful exploitation allows a local user to corrupt kernel memory, which typically leads to a system crash or the potential for privilege escalation and arbitrary code execution within the kernel context. Given the High CVSS score of 8.8, this vulnerability poses a severe risk to the integrity and stability of the underlying host operating system and any co hosted virtual machines.

Immediate Action: Update the Linux kernel to version 7.2.5 or later, or apply the upstream patches provided by the kernel maintainers.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected process termination associated with KVM or virtual machine operations.

Compensating Controls: Restrict access to virtual machine file descriptors to only trusted users or service accounts to limit the attack surface for this specific vector.

Public Exploit Available: No

The severity of this vulnerability, combined with its potential for kernel level memory corruption, necessitates immediate attention. Administrators running Linux on LoongArch hardware should prioritize the deployment of the patched kernel version 7.2.5 to eliminate the risk of unauthorized kernel memory access and potential system compromise.