{"id":"CVE-2026-98877","kind":"vulnerability","aliases":["CVE-2026-98877"],"related":[],"title":"Linux kernel: GICv4 vLPI setup crashes when no ITS is present","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v4: Don't advertise VLPIs if no ITS is probed\n\nWhen accidentally setting “kvm-arm.vgic_v4_enable=1” on a system that has\nno MSI controller device tree node and GICv4, it results a panic as\n“gic_domain” is NULL and the kernel attempts to access it.\n\n    Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028\n    Mem abort info:\n      ESR = 0x0000000096000006\n\n    CPU: 1 UID: 0 PID: 295 Comm: lkvm-static Not tainted 7.1.0-rc4-ge3f15ad3970e #5 PREEMPT\n    Hardware name: linux,dummy-virt (DT)\n    pstate: 81402005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n    pc : __irq_domain_instantiate+0x1d4/0x578\n    lr : __irq_domain_instantiate+0x1cc/0x578\n\nSet vLPI support to false at init time if the host has no ITS, so it\npropagates properly to kvm_vgic_global_state.has_gicv4.","summary":"When the kernel is started with kvm-arm.vgic_v4_enable=1 on an ARM system that has GICv4 but no MSI controller (ITS) device tree node, the GIC irqchip code dereferences a NULL gic_domain and panics. The fix stops advertising vLPI support when no ITS has been probed.","severity":"low","cvss":null,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm64","kvm","linux-kernel","runtime"],"not_affected_if":["default-config"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the commit 'irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed'.","status":"open","published_at":"2026-10-23T12:18:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:13+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:00:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the commit 'irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed'.","reach":"local","title":"Linux kernel: GICv4 vLPI setup crashes when no ITS is present","impact":"low","summary":"When the kernel is started with kvm-arm.vgic_v4_enable=1 on an ARM system that has GICv4 but no MSI controller (ITS) device tree node, the GIC irqchip code dereferences a NULL gic_domain and panics. The fix stops advertising vLPI support when no ITS has been probed.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","arm64","kvm"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel panic (denial of service) during KVM initialization on affected hardware.","analyst_note":"Check the NVD entry or the upstream kernel commit for the affected and fixed kernel version ranges, which the sources here do not give.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running Linux on ARM64 with GICv4 and no ITS node in the device tree, where kvm-arm.vgic_v4_enable=1 is set. Ordinary systems with default KVM settings are unlikely to be affected, and the sources describe a crash rather than code execution or data exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000633,"input_tokens":3648,"output_tokens":536,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':183C,189C '-2026':13A,16A '-98877':14A,17A '0':147C '0000000000000028':138C '0x0000000096000006':143C '1':33B,98C,145C '295':149C '5':160C '7.1.0':156C '81402005':170C 'abort':140C 'access':126C 'accident':93C 'address':137C 'advertis':63B,85C 'arm':36B 'arm64':18B 'attempt':124C 'btype':178C 'code':52B 'comm':150C 'control':44B,106C 'cpu':144C 'crash':6A 'cve':12A,15A 'daif':172C 'derefer':53B,134C 'devic':46B,107C 'dit':176C 'domain':57B,118C,181C,187C 'dt':168C 'dummi':166C 'dummy-virt':165C 'enabl':32B,97C 'esr':142C 'fals':195C 'fix':61B 'follow':77C 'ge3f15ad3970e':159C 'gic':50B,56B,117C 'gicv4':3A,40B,111C,211C 'handl':130C 'hardwar':162C 'host':201C 'info':141C 'init':197C 'instanti':182C,188C 'irq':180C,186C 'irqchip':51B 'irqchip/gic-v4':82C 'kernel':2A,22B,26B,75C,123C,131C 'kvm':19B 'kvm-arm.vgic':30B,95C 'kvm_vgic_global_state.has':210C 'linux':1A,21B,74C,164C 'linux-kernel':20B 'lkvm':152C 'lkvm-static':151C 'lr':185C 'mem':139C 'msi':43B,105C 'name':163C 'node':48B,109C 'null':55B,120C,132C 'nzcv':171C 'pan':173C 'panic':59B,115C 'pc':179C 'pid':148C 'pointer':133C 'preempt':161C 'present':11A 'probe':71B,91C 'propag':207C 'proper':208C 'pstate':169C 'rc4':158C 'rc4-ge3f15ad3970e':157C 'resolv':81C 'result':113C 'runtim':23B 'set':94C,191C 'setup':5A 'ssbs':177C 'start':28B 'static':153C 'stop':62B 'support':65B,193C 'system':37B,101C 'taint':155C 'tco':175C 'time':198C 'tree':47B,108C 'uao':174C 'uid':146C 'unabl':128C 'v4':31B,96C 'virt':167C 'virtual':136C 'vlpi':4A,64B,192C 'vlpis':86C 'vulner':78C 'x1cc/0x578':190C 'x1d4/0x578':184C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux on ARM64 with GICv4 and no ITS node in the device tree, where kvm-arm.vgic_v4_enable=1 is set. Ordinary systems with default KVM settings are unlikely to be affected, and the sources describe a crash rather than code execution or data exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98877","severity":null,"published_at":"2026-10-23T12:18:21+00:00","modified_at":"2026-10-23T12:18:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98877","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98877","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}