Executive brief
The Linux kernel's KVM hypervisor on ARM64 systems contains a flaw in interrupt controller (GICv2) handling that allows a guest virtual machine to trigger a kernel warning and potentially panic the host. When a guest writes an out-of-range interrupt ID to a specific hardware register, the host kernel incorrectly treats this as a fatal error condition. This could be exploited to cause a denial of service on physical servers running virtual machines.
Technical details
The vulnerability exists in the `vgic_v2_deactivate()` function in the ARM64 KVM GICv2 (Generic Interrupt Controller version 2) implementation. The function passes a guest-supplied interrupt ID (INTID) to `vgic_get_vcpu_irq()` and uses `WARN_ON_ONCE()` to flag a NULL return as an unexpected condition. However, GICv2 legitimately returns NULL for interrupt IDs outside the supported SGI, PPI, and SPI ranges (since it lacks LPI support), allowing a guest to intentionally trigger this warning. On hosts configured with `panic_on_warn`, this causes a kernel panic. The fix removes the WARN_ON_ONCE() macro and silently ignores failed lookups, treating out-of-range INTIDs as a normal condition. The patch was made available in Linux kernel versions across multiple stable branches.
Affected products
- Linux Linux kernel Multiple versions (fixes in 6.12.y and later stable branches)
Timeline
- 2026-09-11: disclosed: CVE published
- 2026-08-11: patched: Upstream fix committed
- 2026-07-26: other: Original report/patch submission