CVE-2026-72282

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) component. The kvm_io_bus_get_dev() function, responsible for retrieving I/O bus devices, could return a device that is only matched by its memory address. This creates a race condition where the device might be deallocated before the caller can verify its type, leading to a lifetime issue. This vulnerability could potentially allow an attacker to cause system instability or a denial of service (DoS).

This vulnerability is evaluated with a Moderate severity impact on Red Hat Enterprise Linux because successful exploitation requires local unprivileged or authenticated guest access and is restricted to causing a host denial of service rather than arbitrary code execution. In standard Red Hat deployments, the issue stems from improper synchronization when referencing virtual I/O bus devices within the KVM hypervisor subsystem, particularly affecting virtual interrupt controller operations. Because the attack vector is confined to local interaction with the hypervisor interface, the overall operational risk remains bounded to system availability on virtualization hosts.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.