Executive brief
The Linux kernel's KVM virtualization subsystem contains a use-after-free vulnerability in ARM64 virtual interrupt controller (vgic-v3) code that manages interrupt pending states. An attacker with guest kernel privileges could trigger a race condition by simultaneously manipulating guest interrupt configurations and saving pending interrupt state, potentially causing a kernel crash, data corruption, or privilege escalation on the host system.
Technical details
This is a use-after-free race condition in vgic_v3_save_pending_tables() within arch/arm64/kvm/vgic/vgic-v3.c. The vulnerability occurs because the function iterates over LPI (Locality-specific Peripheral Interrupts) in dist->lpi_xa using xa_for_each() and dereferences the returned struct vgic_irq without holding a stable reference. The xarray iterator provides only temporary RCU coverage during lookup. A concurrent path (irqfd cached injection via vgic_its_inject_cached_translation) can obtain a transient LPI reference and drop it under its_lock, causing the LPI to be freed via kfree_rcu(). Meanwhile, vgic_v3_save_pending_tables() holds a stale pointer that becomes use-after-free after the RCU grace period completes. The fix refetches each iterated LPI via vgic_get_irq() to acquire a stable reference and drops it with vgic_put_irq() on all code paths. The vulnerability requires guest access to ITS (Interrupt Translation Service) and can be triggered from guest kernel code; no network access or additional authentication is required.
Affected products
- Linux Linux kernel multiple versions prior to fix commit f5b8f203bfc07a5a257dff859e66d2c500f9f509
Timeline
- 2026-09-16: disclosed: CVE-2026-89913 published
- 2026-09-11: patched: Fix commit f5b8f203bfc07a5a257dff859e66d2c500f9f509 committed to stable tree