{"id":"CVE-2026-98878","kind":"vulnerability","aliases":["CVE-2026-98878"],"related":[],"title":"Linux kernel: GICv5 interrupt priority drop delayed, blocking other interrupts","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v5: Immediately exec priority drop following activate\n\nWith GICv5 an interrupt of equal or lower priority cannot be signalled\nuntil there has been a priority drop. This is done via the GIC CDEOI\nsystem instruction. Once this has been executed, the hardware is able\nto signal the next interrupt if there is one.\n\nAs all interrupts are programmed to have the same priority, no new\ninterrupts can be signalled until the priority drop has happened. This\ncan cause issues when, for example, an interrupt remains active while\na long running process takes place, such as when injecting a physical\ninterrupt into a guest VM in software.\n\nThe GICv5 driver has so far done the priority drop as part of\nirq_eoi(), i.e., at the same time as deactivating the interrupt. This\nmeans that any long running process (or VM) could block incoming\ninterrupts, effectively causing a denial of service for all other\ninterrupts.\n\nRather than doing the EOI as part of irq_eoi() (which the name would\nsuggest would be a good place for it), move it to happen immediately\nafter acknowledging an interrupt in the main GICv5 interrupt\nhandler. The deactivation of interrupts (GIC CDDI) remains implemented\nas part of irq_eoi(), which means that the same interrupt cannot be\nsignalled a second time until deactivated by software.","summary":"In the Linux GICv5 interrupt controller driver, the priority drop ran only when an interrupt was deactivated, so a long-running handler could hold back all other interrupts. The fix moves the priority drop to run right after an interrupt is acknowledged, which lets other interrupts be signalled sooner; the sources describe this as a denial-of-service risk and do not describe code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm64","gicv5","infrastructure","linux-kernel","virtualization"],"not_affected_if":["no-gicv5-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T12:18:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:12+00:00","updated_at":"2026-10-25T05:00:12+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:00:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: GICv5 interrupt priority drop delayed, blocking other interrupts","impact":"low","summary":"In the Linux GICv5 interrupt controller driver, the priority drop ran only when an interrupt was deactivated, so a long-running handler could hold back all other interrupts. The fix moves the priority drop to run right after an interrupt is acknowledged, which lets other interrupts be signalled sooner; the sources describe this as a denial-of-service risk and do not describe code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","arm64","gicv5","virtualization"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Denial of service: other interrupts are blocked while a handler runs","analyst_note":"Find the affected and fixed kernel versions and the upstream commit in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-98878) or the kernel git tree.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-gicv5-hardware"],"who_is_affected":"Systems running Linux kernels with the GICv5 interrupt controller driver, such as ARM servers and hosts that inject physical interrupts into guest VMs in software. The sources do not list affected kernel versions or say which systems ship GICv5 hardware, so check the kernel version and hardware against the NVD entry.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000641,"input_tokens":3672,"output_tokens":548,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98878':13A,16A 'abl':144C 'acknowledg':66B,282C 'activ':107C,186C 'arm64':17B 'back':49B 'block':8A,241C 'cannot':117C,310C 'caus':178C,245C 'cddi':296C 'cdeoi':133C 'code':89B 'control':29B 'could':47B,240C 'cve':11A,14A 'deactiv':40B,228C,292C,317C 'delay':7A 'denial':81B,247C 'denial-of-servic':80B 'describ':76B,88B 'done':129C,213C 'driver':30B,209C 'drop':6A,33B,58B,105C,126C,173C,216C 'effect':244C 'eoi':221C,258C,263C,303C 'equal':113C 'exampl':182C 'exec':103C 'execut':90B,140C 'far':212C 'fix':54B 'follow':96C,106C 'gic':132C,295C 'gicv5':3A,18B,27B,109C,208C,288C 'good':272C 'guest':203C 'handler':46B,290C 'happen':175C,279C 'hardwar':142C 'hold':48B 'i.e':222C 'immedi':102C,280C 'implement':298C 'incom':242C 'infrastructur':19B 'inject':197C 'instruct':135C 'interrupt':4A,10A,28B,38B,52B,64B,70B,111C,149C,156C,166C,184C,200C,230C,243C,253C,284C,289C,294C,309C 'irq':220C,262C,302C 'irqchip/gic-v5':101C 'issu':179C 'kernel':2A,22B,94C 'let':68B 'linux':1A,21B,26B,93C 'linux-kernel':20B 'long':44B,189C,235C 'long-run':43B 'lower':115C 'main':287C 'mean':232C,305C 'move':55B,276C 'name':266C 'new':165C 'next':148C 'one':153C 'part':218C,260C,300C 'physic':199C 'place':193C,273C 'prioriti':5A,32B,57B,104C,116C,125C,163C,172C,215C 'process':191C,237C 'program':158C 'ran':34B 'rather':254C 'remain':185C,297C 'resolv':100C 'right':61B 'risk':84B 'run':45B,60B,190C,236C 'second':314C 'servic':83B,249C 'signal':72B,119C,146C,169C,312C 'softwar':206C,319C 'sooner':73B 'sourc':75B 'suggest':268C 'system':134C 'take':192C 'time':226C,315C 'via':130C 'virtual':23B 'vm':204C,239C 'vulner':97C 'would':267C,269C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux kernels with the GICv5 interrupt controller driver, such as ARM servers and hosts that inject physical interrupts into guest VMs in software. The sources do not list affected kernel versions or say which systems ship GICv5 hardware, so check the kernel version and hardware against the NVD entry.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98878","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98878","severity":null,"published_at":"2026-10-23T12:18:21+00:00","modified_at":"2026-10-23T12:18:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}