CVE-2026-89727: KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: GICv2: Don't WARN on out-of-range GICVDIR INTID

vgicv2deactivate() passes the INTID a guest wrote to GICVDIR straight to vgicgetvcpuirq(), and treats a failed lookup as a "can't happen" condition with WARNONONCE().

The guest can make it happen at will, though: for any INTID outside of the implemented SGI, PPI and SPI ranges the lookup returns NULL, since GICv2 has no LPIs. A guest running with EOImode==1 writing such an INTID to GICVDIR triggers the WARN, and panics hosts running with paniconwarn.

Drop the WARN and ignore failed lookups.

Event History

Sep 11, 2026
CVE Published
via MITRE·07:46 PM
Data Sourced
via MITRE·07:46 PM
Description

Frequently Asked Questions

1

Which systems are exposed to a host panic?

Hosts using KVM on arm64 with a virtual GICv2 configuration are exposed when a guest runs with EOImode set to 1. A guest can trigger the condition by writing an interrupt ID outside the implemented SGI, PPI, and SPI ranges to GICV_DIR, if the host has panic_on_warn enabled.

2

Does exploitation require host access or a privileged guest?

The described trigger is performed by a guest writing an out-of-range INTID to GICV_DIR while using EOImode==1. The data does not state that host access is required, but it does not specify the guest privilege level needed to perform that register write.

3

What can be done if the fix cannot be applied immediately?

Avoid running affected guests with EOImode==1 where possible. Disabling panic_on_warn prevents the WARN from escalating into a host panic, though the underlying invalid guest input will still produce the warning until the fix is applied.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203