Linux Kernel EUVD-2026-59710

Requires local access to a host running the in-kernel KVM x86 hypervisor with the emulated I/O APIC active (ioapic_in_kernel() true), plus the privilege to open /dev/kvm and issue KVM_RUN with a live vCPU. The attacker must get a delayed I/O APIC EOI work item queued (an asserted IRQ line pending a broadcast EOI) and then trigger VM destruction so the deferred work runs after vCPUs are freed. Limiting factors: it is a teardown race with a narrow timing window (not deterministic), it needs KVM guest-creation rights rather than being reachable by any unprivileged process, it is x86/KVM-specific, and it does not apply to hosts without KVM or with a userspace I/O APIC. This meaningfully constrains real-world risk despite the high CVSS.

Signals conflict on severity versus real-world urgency. The provided CVSS 3.1 base is 9.3 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), driven largely by the scope change (guest-context work corrupting host kernel memory) and full CIA impact typical of kernel UAF. However AC:L understates reality: this is a teardown race (delayed work must still be pending exactly when the VM is destroyed), which is closer to high attack complexity. PR:N is also questionable because triggering requires the ability to open /dev/kvm and issue KVM_RUN - i.e., a live vCPU - which is a privileged/allow-listed capability on typical hosts, not truly unauthenticated. Against that, EPSS is only 0.15% (5th percentile), it is not in CISA KEV, and no public PoC is referenced, so this is a low-probability, patch-in-normal-cycle issue rather than an active threat. The tags label it Denial Of Service; while UAF can in principle be escalated to code execution, no exploit demonstrating that exists here. Net: a legitimately high-CVSS kernel memory-safety bug whose real-world exploitation risk is low and gated on local KVM access and a race window. Note discrepancy to verify with vendor: CVSS says AV:L/PR:N but the description implies local access with KVM privileges.

A local user permitted to use /dev/kvm launches a KVM guest configured with the in-kernel I/O APIC, asserts an interrupt line so a delayed EOI work item is queued, then rapidly tears the VM down to race kvm_destroy_vm() against kvm_ioapic_eoi_inject_work. If the work fires after vCPUs are freed, the kernel reads freed slab memory in __kvm_irq_delivery_to_apic_fast, crashing the host (DoS) or potentially corrupting kernel memory. No public PoC is identified, and the race window plus required KVM access make reliable exploitation nontrivial.