CVE-2026-80699 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context
In the nested state, the physical interrupt has already been deactivated through the HW bit in the LR. The extra deactivation would be harmless but can hit an errata case on AmpereOne, so avoid it here.
On AmpereOne, deactivating a physical interrupt through ICC_DIR_EL1 or ICC_EOIR1_EL1 (depending on EOImode) which is not active, but is the highest priority pending interrupt causes the cpu to lose the interrupt pending state and also prevents the delivery of future interrupts.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel has addressed a critical logic error within the KVM ARM64 virtual generic interrupt controller implementation that specifically impacts nested virtualization environments. This vulnerability centers on the handling of physical interrupt deactivation states when running guest operating systems inside another guest, a scenario known as nested virtualization. In this architecture, the hypervisor must carefully manage the translation and forwarding of hardware interrupts from the underlying physical machine to the innermost guest. The flaw arises because the kernel was performing redundant deactivation operations on interrupts that had already been logically deactivated at the hardware level through the Last Record register mechanism. While such redundancy is generally benign in most processor implementations, it triggers a specific silicon errata present in AmpereOne processors, leading to severe functional failures rather than simple inefficiencies.
The technical root cause lies in the interaction between software-driven interrupt deactivation commands and the current state of the physical interrupt line within the nested context. When an interrupt is processed through the Last Record register, it signals to the hardware that the interrupt has been handled, effectively marking it as inactive at the architectural level. However, the KVM code path was subsequently issuing additional deactivation commands via system registers such as ICC_DIR_EL1 or ICC_EOIR1_EL1, depending on the End Of Interrupt mode configuration. On standard ARM implementations, this double-deactivate is ignored or handled gracefully by the interrupt controller logic. The issue manifests exclusively when the targeted physical interrupt is not currently active but holds the highest priority among all pending interrupts in the system.
The operational impact of this flaw is severe and directly affects system stability on affected hardware platforms like AmpereOne processors. When a double-deactivation occurs under these specific conditions, the CPU erroneously clears the pending state for that interrupt at a deeper architectural level than intended. This results in the permanent loss of the interrupt's pending status, meaning the processor no longer recognizes that an event requiring attention has occurred. Consequently, future interrupts with equal or lower priority may be blocked from delivery because the hardware logic incorrectly assumes the highest-priority pending condition is resolved when it is not. This leads to a state where critical system events are silently dropped, potentially causing guest operating systems to hang, lose connectivity, or experience unpredictable behavior due to missing timer ticks, network packets, or device interrupts.
This vulnerability aligns with CWE-672, which describes the use of operation after unnecessary check or action, as the kernel performs a redundant deactivation that triggers unintended side effects on specific hardware revisions. From an offensive security perspective related to ATT&CK techniques, this flaw could potentially be leveraged in Denial of Service scenarios against virtualized environments if an attacker can control interrupt injection patterns within a nested guest to trigger the errata condition repeatedly. The failure mode represents a reliability issue that compromises the availability and integrity of services running on affected AmpereOne-based cloud instances or bare-metal servers utilizing KVM for isolation.
Mitigation requires applying kernel updates that include patches from upstream Linux maintainers, specifically those addressing the vgic nested context logic to prevent redundant deactivation calls when hardware-level deactivation has already occurred via Last Record registers. System administrators running virtualized workloads on AmpereOne processors should ensure their host kernels are updated to versions containing this fix. Additionally, verifying that hypervisor configurations do not inadvertently expose unpatched kernel features in nested scenarios is advisable until all nodes in the cluster have been patched. Continuous monitoring for interrupt-related timeouts or missing event logs within guests can serve as an indicator of whether older, vulnerable kernel versions remain in use on affected hardware platforms.