A guest running on a RISC‑V virtual machine can request PMU event information with a malicious number of events. Because the host kernel incorrectly calculates the buffer size with a 32‑bit integer, the allocation is too small, leading to out‑of‑bounds reads and writes. The resulting memory corruption can compromise kernel integrity and potentially allow an attacker to execute arbitrary code or elevate privileges. The weakness is classified as CWE‑787, improper buffer bounds checking.

All Linux kernel instances that enable KVM on RISC‑V 64‑bit processors are affected. Any virtual machine that issues PMU EVENT_GET_INFO system calls through the SBI interface and specifies a large event count can trigger the issue.

The CVSS score of 7.0 indicates a high severity vulnerability. The EPSS score is < 1%, indicating a very low probability of exploitation but still possible, but because the flaw can be exercised from within a guest, it is attainable by compromise of any virtual machine. The issue is not listed in CISA KEV, so there is no public knowledge of an active exploit yet. Nonetheless, an attacker who controls a VM can abuse the out‑of‑bounds write to influence the host kernel, making this a serious local privilege escalation vector.