Live › vulnerability › CVE-2026-98712
Go to dashboardIn the Linux kernel's arm64 KVM virtual interrupt controller, the last interrupt inserted into a list register could be freed when a mapped LPI was unmapped concurrently, leaving a dangling reference. The fix takes a reference count on that interrupt and drops it when LPIs are reclaimed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running the Linux kernel with KVM on arm64 hardware that use the virtual GICv3 interrupt controller with LPIs, typically hypervisors running guest virtual machines. Hosts on x86, or arm64 hosts without KVM guests, are not affected by this change. The sources do not say which kernel versions are affected or fixed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq
Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI.
Solve this by bumping up the refcount on the interrupt when populating last_lr_irq, and drop it at vgic_prune_ap_list() time, when LPIs are being reclaimed.
This page as .md · .json · in your agent: get_signal("CVE-2026-98712")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.