CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-v3: take an LPI reference in vgicv3savependingtables
vgicv3savependingtables() iterates dist->lpixa using xaforeach() and dereferences the returned struct vgicirq in the loop body without holding a reference on the LPI.
The xarray iterator only provides temporary RCU coverage while looking up the current entry. That is not sufficient for this loop body, which reads fields from struct vgicirq and performs guest memory accesses before the iteration completes.
A concurrent path can trigger this race: the irqfd cached injection path (vgicitsinjectcachedtranslation) obtains a transient LPI reference via vgicitscheckcache() without holding kvm->lock, vcpu->mutex, configlock, or itslock. If guest ITS DISCARD then drops the cache and ITE references under itslock, the transient inject reference may become the final one. When vgicputirq() drops it, the LPI is erased from lpixa and freed via kfreercu(). Meanwhile, vgicv3savependingtables() may still hold a stale pointer obtained from the xarray iterator and dereference it after the RCU grace period completes.
Fix this by re-fetching each iterated LPI via vgicgetirq(), which takes a stable reference, and dropping it with vgicputirq() on all paths. This matches the pattern already used by other lpixa iterators in the vgic ITS code.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this race?
The issue is in the Linux kernel's KVM arm64 virtual GIC v3 implementation. Exposure requires use of the vgic-v3 LPI handling involved in pending-table saving and ITS cached interrupt injection.
What conditions are needed to trigger the use-after-free?
A concurrent irqfd cached injection can hold a transient LPI reference while a guest ITS DISCARD removes cache and ITE references. If that transient reference becomes the final reference, the LPI can be removed and freed while pending-table saving still dereferences a stale xarray entry.
How can this be mitigated before applying a fix?
The provided information identifies the race through irqfd cached injection and guest ITS DISCARD activity, but does not provide a verified configuration-level mitigation. Prioritize updating affected Linux kernel builds using the listed stable fixes.