Linux kernel KVM arm64 vGIC: double-deactivate of nested IRQs trips an AmpereOne erratum

Impact

In the nested state the physical interrupt has already been deactivated through the HW bit in the list register, but KVM deactivated it a second time. Per the record, on AmpereOne deactivating a physical interrupt that is not active but is the highest-priority pending one makes the CPU lose the interrupt pending state and stop delivering future interrupts. On an Arm datacenter host that is a wedged physical CPU and lost interrupt delivery - a node you reboot rather than drain gracefully, which is expensive when it is holding long-running jobs. The exposure is limited to hosts running nested guests on affected Ampere silicon; elsewhere the extra deactivation is described as harmless.

Who can reach it

Local to the host and driven by guest activity: requires nested virtualization enabled and a guest hypervisor producing the interrupt pattern. Not reachable over the network or from a non-virtualized workload.

What to do

Update the host kernel to a stable release containing the fix and reboot each affected host, migrating or draining guests first. Until the reboot window, not enabling nested virtualization on AmpereOne hosts keeps the path out of reach.

References

Related entries

• Linux kernel MGLRU: stale batch updates after memcg reparenting cause premature OOM killsCVE-2026-80719 · Linux kernel mm MGLRU (per-generation batch accounting across memcg reparenting)Unscored
• Linux kernel KVM x86 MMU: invalid parent role propagates to child shadow pages, use-after-freeCVE-2026-80726 · Linux kernel KVM x86 shadow MMU (child shadow page role derivation)Unscored
• Linux kernel x86/mce: CMCI discovery kicks the MCE polling timer before it is initializedCVE-2026-80727 · Linux kernel x86 MCE (CMCI discovery vs. polling timer initialization order)Unscored
• Linux kernel mm: folio split leaves memcg-charged page-cache xa_nodes off the shadow_nodes list_lruCVE-2026-80729 · Linux kernel mm/huge_memory (page-cache folio split, shadow_nodes list_lru accounting)Unscored
• Linux nvmet-tcp: remote initiator can trip a kernel WARN via an oversized SGL, killing panic-on-warn hostsCVE-2026-80788 · Linux kernel nvmet-tcp (NVMe-over-TCP target SGL allocation)Unscored
• Linux kernel nvmet-tcp: unbounded kernel allocation from an unauthenticated NVMe/TCP peerCVE-2026-80789 · Linux kernel nvmet-tcp (NVMe/TCP target SGL length validation)Unscored