Linux KVM arm64 vgic: double list_del when an LPI leaves the ap_list during migration

Impact

vgic_prune_ap_list() re-checked only that an interrupt's affinity was unchanged before moving it to another vCPU, assuming an interrupt with the same target was still queued on this vCPU's ap_list. vgic_flush_pending_lpis() can remove it and clear irq->vcpu while the locks are dropped, leaving enabled/pending/target_vcpu intact so the affinity check still passes - and list_del() runs a second time on an already-removed entry, corrupting host kernel list state. The fix adds an irq->vcpu == vcpu check. This is a distinct race from the reference-counting bug fixed alongside it, with its own trigger path and its own commits. Same operator consequence on arm64 GPU hosts: a guest corrupts host memory structures and can bring down the node and everything attached to it.

Who can reach it

Local to the host, driven from a guest on an arm64 KVM host with GICv3 ITS LPIs. Unauthenticated from the host's point of view - the guest drives it through normal ITS and redistributor accesses.

What to do

Apply the stable kernel fix (five backport commits listed) and reboot each arm64 KVM host after draining VMs. No runtime mitigation and no fixed distro version in the record; schedule it with the other vgic fixes landing in the same stable releases so a single reboot covers them.

References

Related entries

• Linux vhost/net: use-after-free when a cloned zerocopy skb completes after backend resetCVE-2026-74310 · Linux kernel vhost/net (zerocopy ubuf_info completion)Critical
• Linux kernel (drivers/iommu/intel): The VT-d scalable-mode context entry is zeroed while its Present bit is still setCVE-2026-74439 · Linux kernel (drivers/iommu/intel)Critical
• Linux kernel (arch/x86/kvm): The I/O APIC's delayed EOI work was cancelled only after vCPUs were freed, so the workCVE-2026-74517 · Linux kernel (arch/x86/kvm)Critical
• Linux KVM arm64 vgic: LPI release races re-registration, erasing or leaking the xarray entryCVE-2026-74568 · Linux kernel KVM arm64 vgic (LPI release vs re-registration in dist->lpi_xa)Critical
• Linux kernel (drivers/iommu/arm/arm-smmu-v3): On Arm hosts a virtual device is mapped to only the first of its StreamCVE-2026-74573 · Linux kernel (drivers/iommu/arm/arm-smmu-v3)Critical
• perf sched: integer overflow and strcpy overflow parsing untrusted perf.dataCVE-2026-80671 · Linux perf tool, perf sched register_pid() (perf.data parsing)Critical