CVE-2026-89727
N/A
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID
vgic_v2_deactivate() passes the INTID a guest wrote to GICV_DIR straight to vgic_get_vcpu_irq(), and treats a failed lookup as a "can't happen" condition with WARN_ON_ONCE().
The guest can make it happen at will, though: for any INTID outside of the implemented SGI, PPI and SPI ranges the lookup returns NULL, since GICv2 has no LPIs. A guest running with EOImode==1 writing such an INTID to GICV_DIR triggers the WARN, and panics hosts running with panic_on_warn.
Drop the WARN and ignore failed lookups.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 255de897e7fb918a34845167c572b5bf8e1d9d79 < 78b95c571d021391153a5ac7981e9e4d5cc856a3 | affected |
| Linux | Linux | 255de897e7fb918a34845167c572b5bf8e1d9d79 < c6d9c8ac6521d3049ec90ac58bebd23ed03ac496 | affected |
| Linux | Linux | 6.19 | affected |
| Linux | Linux | 0 < 6.19 | unaffected |
| Linux | Linux | 7.2.4 <= 7.2.* | unaffected |
| Linux | Linux | 7.3-rc1 <= * | unaffected |
Weaknesses
References
- https://git.kernel.org/stable/c/78b95c571d021391153a5ac7981e9e4d5cc856a3
- https://git.kernel.org/stable/c/c6d9c8ac6521d3049ec90ac58bebd23ed03ac496
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.