CVE-2026-98712: KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq

Published Oct 18, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic: Take a refcount on IRQs referenced by lastlrirq

Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI.

Solve this by bumping up the refcount on the interrupt when populating lastlrirq, and drop it at vgicpruneaplist() time, when LPIs are being reclaimed.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 18, 2026

CVE Published

via MITRE·03:46 PM

Data Sourced

via MITRE·03:46 PM

Description

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

The issue is relevant to Linux systems using KVM on arm64 with the virtual GIC (vgic). It involves LPIs and the tracking of an interrupt previously inserted into a list register.

What condition is needed to trigger the flaw?

An LPI must be unmapped concurrently while KVM is still referencing that interrupt through last_lr_irq. The race can allow the referenced interrupt to disappear before it is reclaimed.

What does the fix change?

The fix takes a reference count on the interrupt when last_lr_irq is populated and releases that reference during vgic_prune_ap_list(), when LPIs are reclaimed.

CVE-2026-98712: KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What condition is needed to trigger the flaw?

What does the fix change?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What condition is needed to trigger the flaw?

What does the fix change?