{"id":"CVE-2026-98712","kind":"vulnerability","aliases":["CVE-2026-98712"],"related":[],"title":"Linux KVM arm64: stale interrupt reference can crash or corrupt guest interrupt handling","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq\n\nReferencing the last interrupt inserted in an LR is rather fragile, as\nthis interrupt can vanish if a concurrently unmapped LPI.\n\nSolve this by bumping up the refcount on the interrupt when populating\nlast_lr_irq, and drop it at vgic_prune_ap_list() time, when LPIs are\nbeing reclaimed.","summary":"In the Linux kernel's arm64 KVM virtual interrupt controller, the last interrupt inserted into a list register could be freed when a mapped LPI was unmapped concurrently, leaving a dangling reference. The fix takes a reference count on that interrupt and drops it when LPIs are reclaimed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm64","hypervisor","infrastructure","kvm","linux-kernel"],"not_affected_if":["no-kvm","x86-host"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:24+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:31+00:00","updated_at":"2026-10-25T05:17:31+00:00","category":"infrastructure","confidence":0.35,"triage":{"at":"2026-10-25T05:17:31Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux KVM arm64: stale interrupt reference can crash or corrupt guest interrupt handling","impact":"medium","summary":"In the Linux kernel's arm64 KVM virtual interrupt controller, the last interrupt inserted into a list register could be freed when a mapped LPI was unmapped concurrently, leaving a dangling reference. The fix takes a reference count on that interrupt and drops it when LPIs are reclaimed.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","kvm","arm64","hypervisor"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the kernel.org stable commit and the NVD entry for affected version ranges, fixed commit IDs, and CVSS; the sources give no severity, versions, or exploitability.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["x86-host","no-kvm"],"who_is_affected":"Hosts running the Linux kernel with KVM on arm64 hardware that use the virtual GICv3 interrupt controller with LPIs, typically hypervisors running guest virtual machines. Hosts on x86, or arm64 hosts without KVM guests, are not affected by this change. The sources do not say which kernel versions are affected or fixed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000598,"input_tokens":3390,"output_tokens":518,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98712':16A,19A 'ap':140C 'arm64':3A,20B,32B,86C 'bump':122C 'concurr':54B,116C 'control':36B 'corrupt':10A 'could':45B 'count':64B 'crash':8A 'cve':14A,17A 'dangl':57B 'drop':69B,135C 'fix':60B 'follow':80C 'fragil':108C 'freed':47B 'guest':11A 'handl':13A 'hypervisor':21B 'infrastructur':22B 'insert':40B,102C 'interrupt':5A,12A,35B,39B,67B,101C,111C,128C 'irq':92C,97C,133C 'kernel':26B,30B,78C 'kvm':2A,23B,33B,85C 'last':38B,95C,100C,131C 'leav':55B 'linux':1A,25B,29B,77C 'linux-kernel':24B 'list':43B,141C 'lpi':51B,118C 'lpis':72B,144C 'lr':96C,105C,132C 'map':50B 'popul':130C 'prune':139C 'rather':107C 'reclaim':74B,147C 'refcount':90C,125C 'refer':6A,58B,63B 'referenc':93C,98C 'regist':44B 'resolv':84C 'solv':119C 'stale':4A 'take':61B,88C 'time':142C 'unmap':53B,117C 'vanish':113C 'vgic':87C,138C 'virtual':34B 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Hosts running the Linux kernel with KVM on arm64 hardware that use the virtual GICv3 interrupt controller with LPIs, typically hypervisors running guest virtual machines. Hosts on x86, or arm64 hosts without KVM guests, are not affected by this change. The sources do not say which kernel versions are affected or fixed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98712","severity":null,"published_at":"2026-10-18T16:17:24+00:00","modified_at":"2026-10-19T10:19:35+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}