Linux Kernel KVM EUVD-2026-28657

Upgrade to patched Linux kernel versions: 7.0 or later for mainline users, 6.19.9+ for 6.19.x stable branch users, or 6.18.19+ for 6.18.x stable branch users. Patches are available via kernel.org stable tree at the reference URLs provided. For systems unable to immediately patch, implement compensating controls: (1) Restrict local user access to ARM64 KVM hosts using mandatory access controls (SELinux/AppArmor policies) to prevent untrusted users from creating KVM virtual machines - trade-off is reduced multi-tenancy flexibility, (2) Deploy resource limits via cgroups to prevent memory exhaustion conditions that could trigger vgic_allocate_private_irqs_locked() failures - may impact VM density and performance under legitimate load, (3) Monitor kernel logs for vGIC allocation failures and implement automated VM restart policies to recover from crash conditions - does not prevent exploitation but reduces availability impact. Note that disabling KVM entirely eliminates risk but removes virtualization capabilities. Upstream fix commits: ac6769c8f948 (mainline), b7493f48c3db and a24f1d80fbcd (stable). Validate patch application by checking kernel version post-upgrade and reviewing git log for the specific commit hashes.