UBUNTU-CVE-2026-89913: High severity ubuntu/linux-azure vulnerability

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v3: take an LPI reference in vgicv3savependingtables vgicv3savependingtables() iterates dist->lpixa using xaforeach() and dereferences the returned struct vgicirq in the loop body without holding a reference on the LPI. The xarray iterator only provides temporary RCU coverage while looking up the current entry. That is not sufficient for this loop body, which reads fields from struct vgicirq and performs guest memory accesses before the iteration completes. A concurrent path can trigger this race: the irqfd cached injection path (vgicitsinjectcachedtranslation) obtains a transient LPI reference via vgicitscheckcache() without holding kvm->lock, vcpu->mutex, configlock, or itslock. If guest ITS DISCARD then drops the cache and ITE references under itslock, the transient inject reference may become the final one. When vgicputirq() drops it, the LPI is erased from lpixa and freed via kfreercu(). Meanwhile, vgicv3savependingtables() may still hold a stale pointer obtained from the xarray iterator and dereference it after the RCU grace period completes. Fix this by re-fetching each iterated LPI via vgicgetirq(), which takes a stable reference, and dropping it with vgicputirq() on all paths. This matches the pattern already used by other lpixa iterators in the vgic ITS code.