EUVD-2026-80512
GHSA-6q94-4246-2272
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Local vGIC command interface and deterministic once primed (AV:L/AC:L); requires guest/vCPU access so PR:L not PR:N; guest-to-host crash is S:C with availability-only impact (C:N/I:N/A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
8DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
MAPC with V=0 drops ite->collection but leaves the ITE on the device's ITT list, and vgic_its_save_ite() dereferences it unconditionally. A guest that issues MAPD, MAPTI and then MAPC(V=0) therefore oopses the host when the VMM issues KVM_DEV_ARM_ITS_SAVE_TABLES to migrate it. That sequence is UNPREDICTABLE per the architecture, but KVM already handles the resulting state in the translate, MOVI and DISCARD paths.
Save a zeroed entry, which vgic_its_restore_ite() reads back as invalid. Skipping the ITE instead would leave the ITT slot holding whatever is in guest memory, and restore rejects an entry naming a collection the restored collection table does not have.
AnalysisAI
Linux kernel KVM/arm64 hosts that emulate a vGIC ITS can be crashed with a host kernel NULL-pointer dereference when a guest issues the crafted ITS command sequence MAPD, MAPTI, then MAPC with V=0 and the VMM subsequently performs an ITS table save (KVM_DEV_ARM_ITS_SAVE_TABLES, as used for live migration or snapshotting). Exploitation requires arm64 KVM virtualization with the in-kernel GICv3 ITS, an attacker able to run a guest at guest/tenant privilege (authenticated, PR:L in the assessed vector), and - critically - a host-initiated migration or save operation, since the fault is latent in guest state until the VMM touches the tables. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an arm64 KVM host that emulates a vGIC ITS (GICv3/ITS in-kernel irqchip) AND performs an ITS table save - i.e., live migration or VM state snapshot via the KVM_DEV_ARM_ITS_SAVE_TABLES ioctl. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability issue, not a widely-exploitable priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade arm64 KVM hosts to Linux 6.18.51 or Linux 7.2.5 (or the 7.3-rc1 or later mainline equivalent), or cherry-pick the stable commits 3d4c26b16a04a084fe0bde08ccdd8086570f8bbe, 36df368861d2664291298feeb37dfef43fcae670 and c6c156d931c33b92362383cf76f6d6e1291dcbfe from https://git.kernel.org/stable/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all arm64 hosts running KVM with in-kernel GICv3 ITS emulation and temporarily suspend live migration and snapshot operations for untrusted guests; within 7 days, apply the vendor-released patch for CVE-2026-89912 (patch available per vendor advisory; consult your Linux distribution vendor for the exact kernel version) across all affected hosts, and if immediate patching is not possible, disable ITS emulation or restrict guest privileges to prevent the crafted ITS command sequence; within 30 days, verify patch deployment through configuration audits, update incident response playbooks to include host-wide denial-of-service from guest-triggered NULL dereferences, and review tenant isolation and migration policies to limit exposure.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary host file exfiltration from Cloud Hypervisor VMM versions 34.0-50.0. CVSS 10.0. Patch available.
Incorrect handling of queued local TLB flushes in the Linux kernel's KVM nested-VMX (nVMX) implementation can leave stal
Address-rollover bug in the Linux kernel's KVM/arm64 TLB-by-VA invalidation path causes the hypervisor to silently skip
Race conditions in the arm64 KVM path that invalidates VNCR translations can leave a stale stage-1 TLB entry installed f
Missed TLB invalidations in the arm64 KVM nested-virtualization path of the Linux kernel can leave stale translations fo
Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range
A use-after-free (CWE-416) in the Linux kernel's s390/vfio-ap AP crypto passthrough driver allows a local attacker with
The s390 vfio-ap mediated device (mdev) driver in the Linux kernel fails to actually revoke crypto control-domain access
Stale hardware access to unplugged crypto resources in Linux KVM guests on IBM Z (s390) stems from a logic error in the
Stale TLB entries can be reused by an L2 guest in the Linux kernel's KVM nested virtualization (nVMX) implementation on
Linux kernel's KVM nested-VMX (nVMX) emulation can leave stale L2 guest TLB entries on a physical CPU, because KVM execu
Slab use-after-free in the Linux kernel's KVM x86 MMU lockless rmap aging path affects hosts running Linux 6.15 through
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today