CVE-2026-72289
Received Received - Intake

Use-After-Free in Linux Kernel KVM ARM64 VGIC

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating an interrupt to another vCPU. After reacquiring the locks it only checks that the affinity is unchanged (target_vcpu == vgic_target_oracle(irq)) before moving the interrupt, which assumes that an interrupt whose affinity is preserved is still queued on this vCPU's ap_list. That assumption no longer holds if the interrupt is taken off the ap_list while the locks are dropped. vgic_flush_pending_lpis() removes the interrupt from the list and sets irq->vcpu to NULL, but leaves enabled/pending/target_vcpu untouched. As the interrupt is still enabled and pending, vgic_target_oracle() returns the same target_vcpu, so the affinity check passes and list_del() is run a second time on an entry that has already been removed. Also check that the interrupt is still assigned to this vCPU (irq->vcpu == vcpu) before moving it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72289
EUVD
EUVD-2026-59188

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the KVM (Kernel-based Virtual Machine) subsystem for ARM64 systems. It involves a race condition in the virtual Generic Interrupt Controller (VGIC) where an interrupt migration process fails to verify if an interrupt is still assigned to a virtual CPU before moving it. This can lead to a double-free or use-after-free scenario when the interrupt is removed from a list but later incorrectly processed again.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation for arm64 systems. Detection requires checking kernel logs for related errors or kernel crashes during virtual machine operations. Monitor for messages indicating vgic or interrupt migration issues in dmesg or system logs.

Impact Analysis

If exploited, this vulnerability could allow a malicious guest VM to cause a denial-of-service (DoS) condition on the host system by triggering a kernel crash or unexpected behavior. It may also potentially lead to privilege escalation within the guest VM if combined with other vulnerabilities.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. If immediate patching is not possible, avoid using KVM virtualization on arm64 systems until the patch is applied. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart