Linux KVM arm64 vgic: use-after-free racing LPI disable against interrupt affinity change

Impact

vgic_prune_ap_list() dropped the irq and ap_list locks and reacquired them without holding a reference, so a guest that disables another vCPU's LPIs while a third vCPU migrates a pending LPI can have the interrupt freed in the window - a use-after-free in host kernel memory. The fix takes a reference before dropping the locks and stops trying to migrate the pending bit. This matters on Arm-based GPU hosts (Grace-Hopper and similar) that run KVM guests: a guest controls the timing from inside, so a tenant VM can corrupt host memory, with host crash the reliable outcome and worse not ruled out. Taking the host down means every accelerator attached to it goes with it. x86 hosts are unaffected.

Who can reach it

Local to the host, driven from inside a guest - any tenant VM on an arm64 KVM host whose vGIC has LPIs (GICv3 ITS). No host authentication; the guest only needs to write its own redistributor and ITS.

What to do

Apply the stable kernel fix (three backport commits listed) and reboot each arm64 KVM host after draining its VMs. There is no runtime mitigation short of not running untrusted guests on affected arm64 hosts; the record names no fixed distro release.

References

Related entries

• Linux KVM arm64 vgic: double list_del when an LPI leaves the ap_list during migrationCVE-2026-72289 · Linux kernel KVM arm64 vgic (ap_list ownership check before LPI migration)Critical
• Linux vhost/net: use-after-free when a cloned zerocopy skb completes after backend resetCVE-2026-74310 · Linux kernel vhost/net (zerocopy ubuf_info completion)Critical
• Linux kernel (drivers/iommu/intel): The VT-d scalable-mode context entry is zeroed while its Present bit is still setCVE-2026-74439 · Linux kernel (drivers/iommu/intel)Critical
• Linux kernel (arch/x86/kvm): The I/O APIC's delayed EOI work was cancelled only after vCPUs were freed, so the workCVE-2026-74517 · Linux kernel (arch/x86/kvm)Critical
• Linux KVM arm64 vgic: LPI release races re-registration, erasing or leaking the xarray entryCVE-2026-74568 · Linux kernel KVM arm64 vgic (LPI release vs re-registration in dist->lpi_xa)Critical
• Linux kernel (drivers/iommu/arm/arm-smmu-v3): On Arm hosts a virtual device is mapped to only the first of its StreamCVE-2026-74573 · Linux kernel (drivers/iommu/arm/arm-smmu-v3)Critical