KVM arm64 vgic-v3: unreferenced LPI iteration lets a freed vgic_irq be dereferenced while saving pending tables

Impact

vgic_v3_save_pending_tables() walked dist->lpi_xa with xa_for_each() and dereferenced each struct vgic_irq without taking a reference, relying on RCU coverage that only spans the individual lookup. A guest that drives ITS DISCARD while an irqfd cached injection holds the last transient reference can cause the LPI to be erased and kfree_rcu()'d while the save path still holds the pointer, giving a use-after-free in host kernel context across a guest memory access. On Arm GPU hosts (Grace-class nodes running KVM guests), this is a guest-triggerable host memory corruption primitive, which on a multi-tenant node means one VM potentially reaching host state shared with every other VM on the box. The fix re-fetches each LPI via vgic_get_irq() and drops the reference on all paths.

Who can reach it

Local, from inside a guest VM on an arm64 KVM host: a guest with a virtual ITS that can issue DISCARD while interrupts are being injected, combined with a host operation that saves pending tables. No host credentials needed; x86-only fleets are unaffected.

What to do

Update to a patched kernel using the linked stable commits, then drain and reboot each arm64 KVM host - live guests must be migrated or stopped, as the fix is in the in-use vgic code. No runtime mitigation short of not exposing a virtual ITS to guests.

References

Related entries

• KVM x86/mmu: lockless aging walk re-reads the rmap and can follow a pte_list_desc chain being freedCVE-2026-89928 · Linux kernel KVM x86/mmu (lockless rmap walk in kvm_rmap_age_gfn_range)High
• KVM nVMX: emulated INVVPID can run on the wrong physical CPU, leaving stale L2 TLB entriesCVE-2026-89929 · Linux kernel KVM nVMX (INVVPID emulation, wrong physical CPU)High
• KVM nVMX: vpid02 is not flushed on first use after VMXOFF/VMXON, reusing another VM's TLB entriesCVE-2026-89932 · Linux kernel KVM nVMX (vpid02 allocation, last_vpid reset)High
• Linux kernel dma-direct: dma_direct_alloc_pages() treats a CPU address as a struct page pointerCVE-2026-89995 · Linux kernel dma-direct (dma_direct_alloc_from_pool return type)High
• Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroedCVE-2021-47136 · Linux kernel mlx5_core representor TC path + net/sched tc extensionHigh
• Linux kernel (net/tls): When a BPF socket policy shrinks the plaintext after the ciphertext length was computed, kTLSCVE-2025-38608 · Linux kernel (net/tls)High