CVE-2026-80699
Received Received - Intake

KVM: arm64 vgic IRQ Double-Deactivation Fix

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context In the nested state, the physical interrupt has already been deactivated through the HW bit in the LR. The extra deactivation would be harmless but can hit an errata case on AmpereOne, so avoid it here. On AmpereOne, deactivating a physical interrupt through ICC_DIR_EL1 or ICC_EOIR1_EL1 (depending on EOImode) which is not active, but is the highest priority pending interrupt causes the cpu to lose the interrupt pending state and also prevents the delivery of future interrupts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-80699
EUVD
EUVD-2026-67434

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel affecting the KVM (Kernel-based Virtual Machine) implementation for ARM64 systems. It involves the virtual GIC (Generic Interrupt Controller) handling in nested virtualization scenarios. The issue occurs when the physical interrupt is deactivated twice in nested contexts, which can trigger an errata on AmpereOne processors. The extra deactivation is normally harmless but may cause the CPU to lose pending interrupt states and block future interrupt delivery on affected hardware.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation for arm64 and relates to vGIC handling in nested virtualization. Detection requires checking kernel logs for vGIC-related errors or AmpereOne-specific interrupt handling issues. No direct commands are provided in the context, but monitoring dmesg or kernel logs for vgic or interrupt-related errors may help identify the issue.

Impact Analysis

If you use virtualization with KVM on ARM64, particularly on AmpereOne processors, this vulnerability could cause guest virtual machines to miss interrupts. This may lead to performance degradation, system hangs, or unexpected behavior in virtualized workloads. The impact is hardware-specific and only affects nested virtualization scenarios.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel interrupt handling issue in KVM for arm64 systems. Compliance impacts would only occur if this flaw led to data integrity or availability issues in systems processing regulated data.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this vulnerability. If using AmpereOne hardware, ensure the kernel version includes the patch addressing the ICC_DIR_EL1 or ICC_EOIR1_EL1 errata. Disable nested virtualization if not required as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80699. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart