All vulnerabilities
CVE-2026-98712

Linux: KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8b25393d16a5ca8df907bd7ee1ff2e9d85678b3cAlso 19bc5d79ece613f242b5ec03921a3b465321bfed, 6.20CVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 8b25393d16a5ca8df907bd7ee1ff2e9d85678b3cLinuxCVE List
  • 19bc5d79ece613f242b5ec03921a3b465321bfedLinuxCVE List
  • 6.20LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq

Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI.

Solve this by bumping up the refcount on the interrupt when populating last_lr_irq, and drop it at vgic_prune_ap_list() time, when LPIs are being reclaimed.

Text from CVE List

Affected versions 8

  • Linuxaffected: 6da5e537f5afe091658e846da1949d7e557d2ade before 8b25393d16a5ca8df907bd7ee1ff2e9d85678b3cCVE List
  • Linuxaffected: 6da5e537f5afe091658e846da1949d7e557d2ade before 19bc5d79ece613f242b5ec03921a3b465321bfedCVE List
  • Linuxaffected: cd28ca4c27ed5929f61bbed8a967c20519facb88CVE List
  • Linuxaffected: 6.19.9 before 6.20CVE List
  • Linuxaffected: 7.0CVE List
  • Linuxunaffected: all versions before 7.0CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2