Executive brief
A vulnerability in the Linux kernel's KVM hypervisor for ARM64 systems allows a guest virtual machine to crash the host system. When a guest issues certain interrupt translation table (ITT) operations in an architecturally undefined sequence and then triggers a migration save operation, the host kernel dereferences a NULL collection pointer, causing an oops (kernel crash) that disrupts all virtualization services on the affected system.
Technical details
This is a null pointer dereference vulnerability in the KVM arm64 vGIC-ITS (virtual Generic Interrupt Controller - Interrupt Translation Service) code path. The root cause is in the vgic_its_save_ite() function, which unconditionally dereferences the ite->collection pointer during ITT save operations. An UNPREDICTABLE but valid guest sequence of MAPD (map device), MAPTI (map translation entry), and MAPC with V=0 (map collection with valid bit clear) causes ite->collection to be set to NULL while leaving the ITE on the device's ITT list. When the VMM initiates KVM_DEV_ARM_ITS_SAVE_TABLES for VM migration, the null dereference triggers a kernel oops. The fix adds a NULL check and writes a zeroed entry instead, which the restore path correctly interprets as invalid. No authentication is required; the attack is triggered from within a guest VM via hypervisor APIs.
Affected products
- Linux Linux kernel All versions prior to patch commit c6c156d931c33b92362383cf76f6d6e1291dcbfe
Timeline
- 2026-09-16: disclosed
- 2026-09-11: patched: Fix authored 2026-08-07, committed upstream and to stable branches