---
id: CVE-2026-72289
title: 'KVM: arm64: vgic: Check the interrupt is still ours before migrating it'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: arm64: vgic: Check the interrupt is still ours before migrating it

  vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating
  an interrupt to anoth…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 <
    3893e1fcf6f306b327a8358dcd1cbd077989a240
  - >-
    Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 <
    cb3efe1a354f1638726725c3ecee1ce8d1a7e2dc
  - >-
    Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 <
    da2d249a39a1881681c303ceea33f38ba1c5bbeb
  - >-
    Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 <
    654be81c4c637af12709d47c7efc3302cd336513
  - >-
    Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 <
    e363c0bc0226dc5ea5046a88e9a6864b82c45399
  - >-
    Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 <
    79fdd2aa774e44847cd9bb7edc811e73e3dc7bfe
  - >-
    Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 <
    0658b09cba7fe866c6cd70cd2dcdfdcabe80328f
  - >-
    Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 <
    0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe
  - Linux 4.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:45:52.646883Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:15.201Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72289'
references:
  - url: 'https://git.kernel.org/stable/c/3893e1fcf6f306b327a8358dcd1cbd077989a240'
  - url: 'https://git.kernel.org/stable/c/cb3efe1a354f1638726725c3ecee1ce8d1a7e2dc'
  - url: 'https://git.kernel.org/stable/c/da2d249a39a1881681c303ceea33f38ba1c5bbeb'
  - url: 'https://git.kernel.org/stable/c/654be81c4c637af12709d47c7efc3302cd336513'
  - url: 'https://git.kernel.org/stable/c/e363c0bc0226dc5ea5046a88e9a6864b82c45399'
  - url: 'https://git.kernel.org/stable/c/79fdd2aa774e44847cd9bb7edc811e73e3dc7bfe'
  - url: 'https://git.kernel.org/stable/c/0658b09cba7fe866c6cd70cd2dcdfdcabe80328f'
  - url: 'https://git.kernel.org/stable/c/0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe'
tags:
  - cve.org
epss: 0.00185
epssPercentile: 0.07563
ingestedAt: '2026-10-16T19:46:24.412Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic: Check the interrupt is still ours before migrating it

vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating
an interrupt to another vCPU. After reacquiring the locks it only checks
that the affinity is unchanged (target_vcpu == vgic_target_oracle(irq))
before moving the interrupt, which assumes that an interrupt whose affinity
is preserved is still queued on this vCPU's ap_list.

That assumption no longer holds if the interrupt is taken off the ap_list
while the locks are dropped. vgic_flush_pending_lpis() removes the
interrupt from the list and sets irq->vcpu to NULL, but leaves
enabled/pending/target_vcpu untouched. As the interrupt is still enabled
and pending, vgic_target_oracle() returns the same target_vcpu, so the
affinity check passes and list_del() is run a second time on an entry that
has already been removed.

Also check that the interrupt is still assigned to this vCPU
(irq->vcpu == vcpu) before moving it.

## Affected

- `Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 < 3893e1fcf6f306b327a8358dcd1cbd077989a240`
- `Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 < cb3efe1a354f1638726725c3ecee1ce8d1a7e2dc`
- `Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 < da2d249a39a1881681c303ceea33f38ba1c5bbeb`
- `Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 < 654be81c4c637af12709d47c7efc3302cd336513`
- `Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 < e363c0bc0226dc5ea5046a88e9a6864b82c45399`
- `Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 < 79fdd2aa774e44847cd9bb7edc811e73e3dc7bfe`
- `Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 < 0658b09cba7fe866c6cd70cd2dcdfdcabe80328f`
- `Linux >= 0919e84c0fc1fc73525fdcedefab89ea8460f697 < 0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe`
- `Linux 4.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.