CVE-2026-98712: KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Take a refcount on IRQs referenced by lastlrirq
Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI.
Solve this by bumping up the refcount on the interrupt when populating lastlrirq, and drop it at vgicpruneaplist() time, when LPIs are being reclaimed.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue is relevant to Linux systems using KVM on arm64 with the virtual GIC (vgic). It involves LPIs and the tracking of an interrupt previously inserted into a list register.
What condition is needed to trigger the flaw?
An LPI must be unmapped concurrently while KVM is still referencing that interrupt through last_lr_irq. The race can allow the referenced interrupt to disappear before it is reclaimed.
What does the fix change?
The fix takes a reference count on the interrupt when last_lr_irq is populated and releases that reference during vgic_prune_ap_list(), when LPIs are reclaimed.