Bug 2516526 (CVE-2026-72288)

Summary:	CVE-2026-72288 kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the KVM (Kernel-based Virtual Machine) component for ARM64 architecture in the Linux kernel. This vulnerability arises from a race condition within the virtual Generic Interrupt Controller (vgic) when an interrupt's processor affinity is changed at the same time its Locality-aware Peripheral Interrupt (LPI) is being disabled. This timing issue can lead to a Use-After-Free (UAF) error, where the system attempts to use memory that has already been released. A local attacker could exploit this flaw to cause system instability, potentially resulting in a denial of service or, in some scenarios, arbitrary code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:17:07 UTC

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling

Hyunwoo Kim reports some really bad races should the following
situation occur:

- LPI-I is pending in vcpu-B's AP list
- vcpu-A writes to vcpu-B's RD to disable its LPIs
- vcpu-C moves I from B to C

If the last two race nicely enough, vgic_prune_ap_list() can drop
the irq and AP list locks, reacquire them, and in the interval
the irq has been freed. UAF follows.

The fix is two-fold:

- Before dropping the irq and ap_list locks, take a reference on
  the irq

- Do not try to handle migration of the pending bit: there is no
  expectation that this state is retained, as per the architecture

With that, we're sure that the interrupt is still around, and we
safely remove it from the AP list as it has no target at this
stage (unless another interrupt fires, but that's another story).

Comment 1 Keith Grant 2026-08-18 19:07:09 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081500-CVE-2026-72288-371b@gregkh/T