EUVD-2026-80513
GHSA-x7mw-48gf-2rxm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Guest vCPU access is local with low privilege (AV:L/PR:L); the timing-dependent race gives AC:H; guest-to-host corruption crosses scope (S:C); impact is host crash/DoS (A:H) with minor integrity, no reliable confidentiality.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
8DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
vgic_v3_save_pending_tables() iterates dist->lpi_xa using xa_for_each() and dereferences the returned struct vgic_irq in the loop body without holding a reference on the LPI.
The xarray iterator only provides temporary RCU coverage while looking up the current entry. That is not sufficient for this loop body, which reads fields from struct vgic_irq and performs guest memory accesses before the iteration completes.
A concurrent path can trigger this race: the irqfd cached injection path (vgic_its_inject_cached_translation) obtains a transient LPI reference via vgic_its_check_cache() without holding kvm->lock, vcpu->mutex, config_lock, or its_lock. If guest ITS DISCARD then drops the cache and ITE references under its_lock, the transient inject reference may become the final one. When vgic_put_irq() drops it, the LPI is erased from lpi_xa and freed via kfree_rcu(). Meanwhile, vgic_v3_save_pending_tables() may still hold a stale pointer obtained from the xarray iterator and dereference it after the RCU grace period completes.
Fix this by re-fetching each iterated LPI via vgic_get_irq(), which takes a stable reference, and dropping it with vgic_put_irq() on all paths. This matches the pattern already used by other lpi_xa iterators in the vgic ITS code.
AnalysisAI
A use-after-free race in the arm64 KVM vGICv3 code path of the Linux kernel (vgic_v3_save_pending_tables) allows a locally authenticated guest with vCPU-level access to trigger a dangling-pointer dereference against host kernel memory. The flaw requires an arm64 KVM host configured with GICv3 LPI/ITS support, where a concurrent irqfd cached-injection plus a guest ITS DISCARD can free an LPI that the pending-table save loop still holds via a stale xarray iterator pointer; the practical outcome is a host-side crash/denial of service with limited integrity impact rather than a clean, reliable privilege escalation, and exploitation depends on a tight timing window (assessed AV:L/AC:H/PR:L, S:C, C:N/I:L/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an arm64 KVM host with vGICv3 emulation and LPI/ITS support, and a local guest with vCPU-level access (PR:L) able to drive ITS operations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a use-after-free triggered by a race condition (CWE-416/CWE-362) in the arm64 KVM vGICv3 code path vgic_v3_save_pending_tables(), which iterates dist->lpi_xa under only transient RCU coverage and dereferences a struct vgic_irq that a concurrent irqfd cached-injection path plus a guest ITS DISCARD can free via kfree_rcu(). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading to Linux 6.18.51, 7.2.5, or 7.3-rc1 (or any later stable release containing the fix commits 7631f95297560157d3a9283cb999e3be00103348, d3a2d20b7248ea67465af1cf79c79f90ff70926c, or f5b8f203bfc07a5a257dff859e66d2c500f9f509); distribution kernels should be updated to the corresponding backport once available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all arm64 Linux hosts running KVM with GICv3 LPI/ITS support and inventory kernel versions; prioritize patching to Linux 6.18.51, 7.2.5, or 7.3-rc1 where feasible, or isolate critical hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary host file exfiltration from Cloud Hypervisor VMM versions 34.0-50.0. CVSS 10.0. Patch available.
Incorrect handling of queued local TLB flushes in the Linux kernel's KVM nested-VMX (nVMX) implementation can leave stal
Address-rollover bug in the Linux kernel's KVM/arm64 TLB-by-VA invalidation path causes the hypervisor to silently skip
Race conditions in the arm64 KVM path that invalidates VNCR translations can leave a stale stage-1 TLB entry installed f
Missed TLB invalidations in the arm64 KVM nested-virtualization path of the Linux kernel can leave stale translations fo
Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range
A use-after-free (CWE-416) in the Linux kernel's s390/vfio-ap AP crypto passthrough driver allows a local attacker with
The s390 vfio-ap mediated device (mdev) driver in the Linux kernel fails to actually revoke crypto control-domain access
Stale hardware access to unplugged crypto resources in Linux KVM guests on IBM Z (s390) stems from a logic error in the
Stale TLB entries can be reused by an L2 guest in the Linux kernel's KVM nested virtualization (nVMX) implementation on
Linux kernel's KVM nested-VMX (nVMX) emulation can leave stale L2 guest TLB entries on a physical CPU, because KVM execu
Slab use-after-free in the Linux kernel's KVM x86 MMU lockless rmap aging path affects hosts running Linux 6.15 through
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today