Bug 2555054 (CVE-2026-98712)

Summary:	CVE-2026-98712 kernel: KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for ARM64. The virtual interrupt controller fails to maintain an appropriate reference count on active interrupts, allowing them to be reclaimed and freed while still in use. A malicious guest user could exploit this issue during concurrent interrupt unmapping to trigger a use-after-free condition, resulting in a Denial of Service (DoS) by crashing the host system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-18 15:51:51 UTC

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq

Referencing the last interrupt inserted in an LR is rather fragile, as
this interrupt can vanish if a concurrently unmapped LPI.

Solve this by bumping up the refcount on the interrupt when populating
last_lr_irq, and drop it at vgic_prune_ap_list() time, when LPIs are
being reclaimed.

Comment 1 Mauro Matteo Cascella 2026-10-22 10:37:31 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98712.mbox