Linux Kernel CVE-2026-89912

Requires an arm64 KVM host that emulates a vGIC ITS (GICv3/ITS in-kernel irqchip) AND performs an ITS table save - i.e., live migration or VM state snapshot via the KVM_DEV_ARM_ITS_SAVE_TABLES ioctl. The attacker must be able to run a guest and issue the crafted ITS command sequence MAPD → MAPTI → MAPC(V=0) through an emulated vCPU (so effectively guest/tenant-level privilege, not truly unauthenticated). The crash is NOT self-triggered by the guest: it is latent until the host VMM initiates a save/migrate operation, which is the limiting factor - hosts that never migrate or snapshot the crafted VM are not affected. The triggering command sequence is architecturally UNPREDICTABLE, so it never occurs from a well-behaved guest and must be deliberately constructed.

This is a genuine but bounded availability issue, not a widely-exploitable priority. The vendor CVSS is 7.1 (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) - a pure host-crash DoS (C:N/I:N/A:H) reachable across a scope boundary (guest to host). No EPSS score, no CISA KEV listing, and no public PoC are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The most important nuance the raw score hides is a two-actor trigger: a malicious guest can prime the ITS state (MAPD → MAPTI → MAPC with V=0), but the NULL dereference in vgic_its_save_ite() only fires when the host VMM issues KVM_DEV_ARM_ITS_SAVE_TABLES - i.e., during a save/migration operation initiated by the host operator. The vendor's PR:N is therefore questionable: exploitation requires the ability to run a guest and issue ITS commands via an emulated vCPU, which is closer to PR:L. The description explicitly notes the MAPD/MAPTI/MAPC(V=0) sequence is 'UNPREDICTABLE per the architecture,' meaning no correct guest generates it - it must be deliberately crafted. Net: a real, deterministic host-DoS on arm64 KVM hosts that emulate a vGIC ITS and perform live migration/save, but with a low likelihood of opportunistic mass exploitation.

A tenant on a shared arm64 KVM host runs a crafted guest that issues MAPD, MAPTI, then MAPC with V=0, leaving an ITE on the device ITT list whose collection pointer is NULL. When the host operator later live-migrates or snapshots that VM (KVM_DEV_ARM_ITS_SAVE_TABLES), vgic_its_save_ite() dereferences the NULL collection and oopses the host kernel, taking down the hypervisor and all co-resident guests. No public exploit code is identified at time of analysis.