CVE-2026-89727: KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: GICv2: Don't WARN on out-of-range GICVDIR INTID
vgicv2deactivate() passes the INTID a guest wrote to GICVDIR straight to vgicgetvcpuirq(), and treats a failed lookup as a "can't happen" condition with WARNONONCE().
The guest can make it happen at will, though: for any INTID outside of the implemented SGI, PPI and SPI ranges the lookup returns NULL, since GICv2 has no LPIs. A guest running with EOImode==1 writing such an INTID to GICVDIR triggers the WARN, and panics hosts running with paniconwarn.
Drop the WARN and ignore failed lookups.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In KVM arm64 GICv2 vgic_v2_deactivate(), drop the WARN_ON_ONCE() for failed vgic_get_vcpu_irq() lookups and ignore out-of-range GICV_DIR INTIDs.
Event History
Frequently Asked Questions
Which systems are exposed to a host panic?
Hosts using KVM on arm64 with a virtual GICv2 configuration are exposed when a guest runs with EOImode set to 1. A guest can trigger the condition by writing an interrupt ID outside the implemented SGI, PPI, and SPI ranges to GICV_DIR, if the host has panic_on_warn enabled.
Does exploitation require host access or a privileged guest?
The described trigger is performed by a guest writing an out-of-range INTID to GICV_DIR while using EOImode==1. The data does not state that host access is required, but it does not specify the guest privilege level needed to perform that register write.
What can be done if the fix cannot be applied immediately?
Avoid running affected guests with EOImode==1 where possible. Disabling panic_on_warn prevents the WARN from escalating into a host panic, though the underlying invalid guest input will still produce the warning until the fix is applied.