CVE-2026-89912 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
MAPC with V=0 drops ite->collection but leaves the ITE on the device's ITT list, and vgic_its_save_ite() dereferences it unconditionally. A guest that issues MAPD, MAPTI and then MAPC(V=0) therefore oopses the host when the VMM issues KVM_DEV_ARM_ITS_SAVE_TABLES to migrate it. That sequence is UNPREDICTABLE per the architecture, but KVM already handles the resulting state in the translate, MOVI and DISCARD paths.
Save a zeroed entry, which vgic_its_restore_ite() reads back as invalid. Skipping the ITE instead would leave the ITT slot holding whatever is in guest memory, and restore rejects an entry naming a collection the restored collection table does not have.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's KVM subsystem for ARM64 architectures contains a critical vulnerability within the virtual Generic Interrupt Controller (VGIC) implementation, specifically affecting the Interrupt Translation Table (ITT) handling logic in the vgic-its module. This flaw manifests as an unconditional dereference of a NULL pointer during the save operation of interrupt translation entries. The root cause lies in the interaction between specific Guest Physical Address Space management commands and the internal state tracking mechanisms of the virtualized hardware emulation layer. When a guest operating system issues a sequence comprising MAPD, MAPTI, and subsequently MAPC with the Valid bit set to zero, the kernel correctly drops the reference to the interrupt collection associated with that entry. However, it fails to remove the corresponding Interrupt Translation Entry from the device's ITT list structure. This inconsistency creates a state where the data structure retains a pointer to an object that has been logically invalidated or deallocated within the context of the virtualization layer.
The operational impact becomes severe when the Virtual Machine Monitor attempts to perform live migration by invoking the KVM_DEV_ARM_ITS_SAVE_TABLES ioctl command. During this process, the vgic_its_save_ite function iterates through the ITT list and unconditionally dereferences the collection pointer for each entry. Because the previous MAPC operation with V=0 left a dangling NULL reference in the list while keeping the entry visible to iteration logic, the save routine attempts to access memory at address zero or an invalid location. This results in a kernel oops, effectively crashing the host system and causing a denial of service for all virtual machines running on that physical server. Although the architectural specification defines this specific sequence as unpredictable behavior, robust hypervisors are expected to handle such edge cases gracefully rather than failing catastrophically. The existing codebase already demonstrates resilience in other paths like translate, MOVI, and DISCARD by handling similar invalid states, making this inconsistency a clear oversight in the save path implementation.
From a security perspective, this vulnerability aligns with CWE-476, which describes NULL Pointer Dereference vulnerabilities that can lead to application crashes or denial of service conditions. In the context of cloud computing environments where KVM is widely deployed for virtualization, such a flaw allows a malicious guest user who has access to configure interrupt routing tables to trigger a host-level crash simply by issuing specific configuration commands followed by a migration request initiated by the administrator or orchestration layer. This represents a significant risk as it undermines the isolation guarantees provided by hardware-assisted virtualization. The attack vector is local but requires privilege escalation within the guest OS to issue the MAPC command, yet the impact extends beyond the guest boundary to compromise host stability.
To mitigate this vulnerability and ensure system resilience against similar architectural edge cases, developers have implemented a fix that modifies the save logic to handle invalid entries explicitly rather than assuming all list items contain valid collection pointers. The solution involves saving a zeroed entry when an ITT item lacks a valid collection reference. This approach ensures data consistency during migration because the corresponding restore function, vgic_its_restore_ite, interprets a zeroed entry as invalid and handles it appropriately without attempting to map non-existent collections. Skipping the ITE entirely was rejected as a potential fix because it would leave stale or uninitialized memory contents in the ITT slot on the destination host, which could lead to further undefined behavior during restoration since the restore process validates that named collections exist in the restored collection table. This patch reinforces the principle of defensive programming within kernel virtualization components by ensuring state consistency across save and restore operations regardless of guest-initiated invalid configurations.