Linux Kernel EUVD-2026-80513

Requires an arm64 KVM host with vGICv3 emulation and LPI/ITS support, and a local guest with vCPU-level access (PR:L) able to drive ITS operations. Concretely, the attacker must trigger the irqfd cached injection path (vgic_its_check_cache) together with a guest ITS DISCARD that drops the final LPI reference, precisely while the host is executing vgic_v3_save_pending_tables() - a code path exercised during vGIC state save/migration. Exploitation is limited by this tight timing window (a genuine race, hence AC:H), by requiring GICv3-with-LPI configuration rather than GICv2, and by needing the save-pending-tables operation to be in flight; it is not reachable against a host that never performs the concurrent save path.

This is a use-after-free triggered by a race condition (CWE-416/CWE-362) in the arm64 KVM vGICv3 code path vgic_v3_save_pending_tables(), which iterates dist->lpi_xa under only transient RCU coverage and dereferences a struct vgic_irq that a concurrent irqfd cached-injection path plus a guest ITS DISCARD can free via kfree_rcu(). The vendor CVSS is 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), but several metrics look inflated for a narrow teardown/injection race: AC:L is questionable because triggering the stale-pointer dereference requires precisely interleaving the LPI reference-drop with an in-progress pending-table save (which itself typically runs only during vGIC state save/migration), so AC:H is more defensible. The confidentiality/integrity impact is also overstated - the practical outcome of a freed vgic_irq dereference is host-kernel memory corruption and crash (DoS-dominant), not a reliable read/write primitive, so C:H/I:H are optimistic. S:C is legitimate: a guest vCPU context influences and corrupts host-kernel state, crossing a security boundary. There is no KEV listing, no public POC, and no EPSS signal provided, so despite the high vendor score this is best treated as a real but lower-urgency host-stability/DoS issue affecting a specific platform (arm64 KVM with GICv3 LPIs/ITS), not a broadly weaponizable RCE. Note the input Tag 'Code Injection' conflicts with the actual vulnerability class (a UAF/race, not code injection) and the CWE field is N/A - verify classification with the kernel advisory.

A malicious or compromised guest on an arm64 KVM host with GICv3 emulation drives ITS operations (cached MSI/LPI injection via irqfd combined with an ITS DISCARD that drops the final LPI reference) while the host concurrently saves vGIC pending tables (e.g., during live migration or vGIC state save). Winning the race causes vgic_v3_save_pending_tables() to dereference and perform guest-memory accesses through a freed struct vgic_irq, corrupting host-kernel memory and crashing the host. No public exploit is identified at time of analysis, and the required interleaving makes reliable exploitation difficult.