Linux kernel KVM arm64: failed vGIC creation leaves redistributor regions uninitialised for teardown

Impact

If vgic_allocate_private_irqs_locked() fails, kvm_vgic_create() exits early with dist->rd_regions never initialised, and kvm_vgic_dist_destroy() then walks that uninitialised state while freeing redistributor regions. The result is a host kernel fault triggered from VM creation, taking down every workload on the hypervisor rather than just the VM that failed to start. That matters on arm64 GPU hosts, where one node carries several accelerators and cannot be drained cheaply. The failure needs the allocation to actually fail, so in practice it requires memory pressure; the published vector is availability-only (C:N/I:N/A:H).

Who can reach it

Local, authenticated: anything that can create VMs on an arm64 KVM host - a cloud control plane, or a tenant with VM-creation rights - combined with host memory pressure that makes the private-IRQ allocation fail.

What to do

Take the stable kernel update that moves the static vGIC initialisation early and makes the half-failed path safe to tear down; this is a host kernel patch, so each arm64 hypervisor must be drained and rebooted onto the fixed kernel. No separate mitigation is published.

References

Related entries

• Linux kernel CephFS client: leaked path buffers on error paths exhaust kernel memoryCVE-2026-43419 · Linux kernel CephFS client (ceph_mdsc_build_path error paths)Medium
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeCVE-2026-43444 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium
• Linux kernel KVM on AMD: stale CR8 write intercept after AVIC activation desynchronises guest TPRCVE-2026-43483 · Linux kernel KVM/SVM (CR8 write interception vs AVIC activation)Medium
• Linux kernel BPF cgroup storage: bogus pointer read and key copied to userspace at end of listCVE-2026-45838 · Linux kernel BPF (cgroup_storage_get_next_key() end-of-list detection)Medium
• Linux kernel SUNRPC auth_gss: kernel memory leaks on GSS-proxy XDR decode error pathsCVE-2026-45870 · Linux kernel SUNRPC auth_gss (gssx_dec_ctx / gssx_dec_status / gssx_dec_name XDR decode)Medium
• Linux kernel (drivers/pci): A failed mmap of peer-to-peer DMA memory leaks the pgmap reference it took, and the leak isCVE-2026-45880 · Linux kernel (drivers/pci)Medium