CVE-2026-72288

A flaw was found in the KVM (Kernel-based Virtual Machine) component for ARM64 architecture in the Linux kernel. This vulnerability arises from a race condition within the virtual Generic Interrupt Controller (vgic) when an interrupt's processor affinity is changed at the same time its Locality-aware Peripheral Interrupt (LPI) is being disabled. This timing issue can lead to a Use-After-Free (UAF) error, where the system attempts to use memory that has already been released. A local attacker could exploit this flaw to cause system instability, potentially resulting in a denial of service or, in some scenarios, arbitrary code execution.

This flaw is assessed with a Moderate severity rating because successful exploitation demands tight timing synchronization between multiple virtual processors to hit the race condition on 64-bit ARM hypervisors. The issue exclusively affects Red Hat Enterprise Linux running as a KVM host on ARM64 hardware; non-ARM architectures do not implement this virtual interrupt controller logic and are unaffected. An attacker with access to a guest virtual machine could attempt to trigger the memory corruption to crash the host kernel, leading to a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.