CVE-2026-72288

Received Received - Intake

Race Condition in Linux Kernel KVM ARM64 vgic

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling Hyunwoo Kim reports some really bad races should the following situation occur: - LPI-I is pending in vcpu-B's AP list - vcpu-A writes to vcpu-B's RD to disable its LPIs - vcpu-C moves I from B to C If the last two race nicely enough, vgic_prune_ap_list() can drop the irq and AP list locks, reacquire them, and in the interval the irq has been freed. UAF follows. The fix is two-fold: - Before dropping the irq and ap_list locks, take a reference on the irq - Do not try to handle migration of the pending bit: there is no expectation that this state is retained, as per the architecture With that, we're sure that the interrupt is still around, and we safely remove it from the AP list as it has no target at this stage (unless another interrupt fires, but that's another story).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72288

EUVD

EUVD-2026-59187

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation for ARM64 systems. It occurs due to a race condition involving interrupt affinity changes and disabling of LPIs (Locally Processed Interrupts). The issue arises when an interrupt is pending in one CPU's list, another CPU disables LPIs, and a third CPU moves the interrupt. This can lead to the interrupt being freed while still in use, causing a UAF condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation for arm64 systems and involves race conditions in interrupt handling. Detection requires kernel-level inspection rather than network scanning. Check kernel logs for KVM-related errors or warnings using commands like 'dmesg | grep -i kvm' or 'journalctl -k | grep -i kvm'. If you suspect exploitation, monitor for unexpected crashes or instability in virtual machines.

Impact Analysis

This vulnerability could allow an attacker with local access to a virtual machine to potentially execute arbitrary code, escalate privileges, or cause a denial-of-service condition on the host system. It specifically affects systems using KVM for ARM64 virtualization.

Compliance Impact

This vulnerability is a Linux kernel issue related to KVM virtualization on arm64 systems. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than low-level kernel interrupt handling. The issue involves a race condition in interrupt management that could lead to use-after-free (UAF) errors in virtualized environments.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. If immediate patching is not possible, consider disabling KVM virtualization temporarily if it is not critical for your operations. Monitor vendor advisories for updates and test patches in a non-production environment before full deployment.

Hi! I’m here to help you understand CVE-2026-72288. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70