KVM arm64 vgic-its: guest MAPC with V=0 crashes the host when the VMM saves ITS tables

Impact

A guest that issues MAPD, MAPTI and then MAPC with V=0 leaves an ITE on the device's ITT list with its collection pointer dropped; vgic_its_save_ite() dereferences it unconditionally, so the host oopses the moment the VMM asks for KVM_DEV_ARM_ITS_SAVE_TABLES. The trigger is live migration or save/restore of the guest, which is an operator action, so a tenant VM can arm a trap that fires when the fleet is rebalanced or drained. On arm64 GPU hosts that means the hypervisor goes down and every other VM on that host goes with it - a single tenant crossing the tenancy boundary to take out the node. Confidentiality and integrity are not affected; this is a host availability bug.

Who can reach it

A guest with an arm64 KVM vGIC ITS - i.e. any tenant VM on an affected arm64 host - plus a subsequent VMM-initiated ITS table save (migration, snapshot). No host authentication needed by the attacker.

What to do

Take the stable-kernel fix (save a zeroed entry, which restore reads back as invalid; commits below) and reboot each arm64 hypervisor host after draining its VMs. No mitigation short of the patch other than not migrating or snapshotting untrusted arm64 guests. x86 hosts are unaffected.

References

Related entries

• KVM x86 Hyper-V stimer: overflowed deadline livelocks the vCPU thread and stalls RCU on the hostCVE-2026-89927 · Linux kernel KVM x86 Hyper-V synthetic timer (stimer deadline calculation)High
• KVM: Improper handling of VM_IO/VM_PFNMAP vmas in KVM lets a guest bypass read-only checksCVE-2021-22543 · KVMHigh
• Linux kernel (af_packet): Double free in packet_set_ring(), local privilege escalationCVE-2021-22600 · Linux kernel (af_packet)High
• Linux kernel (eBPF): eBPF improper input validation leading to local privilege escalationCVE-2021-4204 · Linux kernel (eBPF)High
• Linux kernel (cgroups v1): cgroups v1 release_agent lets a container with CAP_SYS_ADMIN (or an unconfined userns) runCVE-2022-0492 · Linux kernel (cgroups v1)High
• Linux kernel (io_uring): Use-after-free between io_uring and the unix GC - local rootCVE-2022-2602 · Linux kernel (io_uring)High