CVE-2026-72289

A flaw was found in the KVM (Kernel-based Virtual Machine) arm64 vgic (Virtual Generic Interrupt Controller) component of the Linux kernel. During interrupt migration, the vgic_prune_ap_list() function temporarily drops and reacquires locks. If an interrupt is removed from the active processor list (ap_list) during this unlocked period, a subsequent check for interrupt affinity may still pass, leading to a double deletion of the interrupt from the list. This double free-like condition could potentially lead to system instability or denial of service.

KVM arm64 vgic has a race in vgic_prune_ap_list while migrating a pending interrupt between vCPUs. The code drops locks and later checks only that the target affinity is unchanged, but the interrupt may already have been removed from the old ap_list by vgic_flush_pending_lpis while enabled and pending state still makes the affinity check pass. This can make list_del run a second time on an already removed list entry, leading to host kernel list corruption or a crash. For the CVSS the PR:L is used because the attacker typically needs the ability to run or control a guest VM or local KVM context, not full host administrator privileges. The issue is not directly network reachable and is a local or guest-to-host virtualization attack surface. Impact is at least denial of service on the host.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.