CVE-2026-72295

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for LoongArch architecture. An unvalidated interrupt controller (irqchip) index in the irqfd routing mechanism could allow a local attacker to perform an out-of-bounds memory access. This could lead to a denial of service or potentially privilege escalation within the system.

This vulnerability is evaluated as having a Moderate severity impact because exploitation requires local access with virtualization privileges on LoongArch hardware, restricting the blast radius to a localized denial of service or host privilege escalation. Red Hat Enterprise Linux does not support the LoongArch processor architecture, and the vulnerable KVM code is not included in shipped kernel packages. As a result, supported Red Hat products are not impacted by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.