CVE-2026-98712 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq
Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI.
Solve this by bumping up the refcount on the interrupt when populating last_lr_irq, and drop it at vgic_prune_ap_list() time, when LPIs are being reclaimed.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel's KVM implementation for ARM64 architectures contains a critical race condition within its virtual Generic Interrupt Controller (vgic) subsystem that can lead to use-after-free vulnerabilities and system instability. This flaw specifically affects the handling of Locality-specific Peripheral Interrupts, or LPIs, which are dynamically allocated and managed interrupts used in modern ARM systems. The vulnerability arises from how the kernel tracks the last interrupt inserted into a List Register (LR), a hardware structure that holds pending virtual interrupts for processing by the guest operating system. When an interrupt is placed into an LR, the kernel stores a reference to it in a variable known as last_lr_irq. This mechanism allows the hypervisor to manage state transitions and ensure proper delivery of interrupts to the virtual machine. However, this approach relies on the assumption that the referenced interrupt object will remain valid for the duration of its presence in the List Register.
The core technical flaw lies in the lack of reference counting protection during concurrent operations involving LPI unmapping. In a multi-threaded environment or under heavy load, an LPI can be concurrently unmapped and reclaimed by the kernel's memory management subsystem while it is still referenced as the last_lr_irq. Because no additional reference count was held on this specific interrupt instance, its underlying data structures could be freed prematurely. When subsequent code attempts to access or manipulate this now-freed memory region through the stale pointer stored in last_lr_irq, a use-after-free condition occurs. This type of vulnerability is classified under CWE-416, which describes using an invalidated reference to an object, and it poses significant risks including kernel panics, data corruption, and potentially arbitrary code execution if an attacker can influence the memory allocation patterns following the free operation.
The operational impact of this vulnerability extends beyond simple system crashes. In a virtualized environment, such as those provided by KVM on ARM64 hosts, stability is paramount for maintaining service availability. A kernel panic triggered by this race condition results in immediate downtime for all virtual machines hosted on that physical node. Furthermore, the use-after-free nature of the bug creates an attack surface where malicious guests or compromised host processes might exploit the memory corruption to escalate privileges from a guest environment to the hypervisor level, thereby gaining control over the entire physical infrastructure. This represents a severe breach in isolation boundaries, violating fundamental security principles required for secure multi-tenancy in cloud computing environments.
To mitigate this vulnerability, developers implemented a fix that introduces explicit reference counting mechanisms into the interrupt handling logic. Specifically, when an interrupt is populated as the last_lr_irq, its reference count is incremented to ensure it remains alive even if other parts of the system attempt to unmap or reclaim it concurrently. The corresponding decrement operation is carefully placed within vgic_prune_ap_list(), a function responsible for cleaning up and reclaiming LPIs that are no longer needed by any virtual machine. This ensures that the interrupt object persists only as long as there is an active reference from either the List Register tracking mechanism or other valid kernel structures, preventing premature deallocation.
From a broader security perspective, this fix aligns with best practices for managing dynamic resources in concurrent systems, emphasizing the importance of lifetime management through reference counting to prevent dangling pointer issues. It also relates to ATT&CK technique T1059, Command and Scripting Interpreter, as such kernel vulnerabilities are often leveraged during post-exploitation phases to achieve privilege escalation on Linux-based hosts. Administrators running affected versions of the Linux kernel should apply the latest available patches that include this KVM ARM64 vgic fix. Regular updates to the host operating system are essential to close these low-level race conditions, and organizations should consider implementing automated vulnerability scanning tools to detect unpatched kernels in their virtualization infrastructure. Additionally, enabling Kernel Address Sanitizer (KASAN) during development or testing phases can help identify similar reference counting errors before they reach production environments.