Executive brief
A vulnerability in the Linux kernel's virtualization component (KVM) for ARM64 systems could lead to a resource leak. When the system fails to create a new virtual processor, it may fail to properly release allocated memory for private interrupts. This could potentially be used to exhaust system resources or cause instability in environments running virtual machines.
Technical details
A memory leak exists in the Linux kernel's KVM implementation for arm64 architecture within the vGIC (Virtual Generic Interrupt Controller) component. The function kvm_arch_vcpu_create() failed to call kvm_vgic_vcpu_destroy() when kvm_vgic_vcpu_init() returned an error. This results in private_irqs, which are allocated on demand, not being freed if a subsequent step (such as redistributor iodev registration) fails. An attacker with the ability to trigger vCPU creation failures could potentially cause a kernel memory leak. The issue has been resolved by ensuring proper cleanup in the error handling path.
Affected products
- Linux Linux 6.10 to 7.1
Timeline
- 2026-05-19: other: Patch submitted by developer
- 2026-07-19: advisory: CVE published by NVD