CVE-2026-74517

A flaw was found in KVM (Kernel-based Virtual Machine). This vulnerability occurs when the system attempts to process a delayed I/O APIC End-of-Interrupt (EOI) after the associated virtual CPUs (vCPUs) have been destroyed. This timing issue results in a Use-After-Free (UAF) condition, where the system tries to access freed memory. A malicious guest virtual machine could exploit this flaw to trigger a system crash, leading to a Denial of Service.

A host kernel use after free can occur in KVM x86 because delayed IO APIC EOI work may run after vCPUs have already been destroyed. The delayed worker can re enter interrupt delivery and read freed vCPU or LAPIC related state in __kvm_irq_delivery_to_apic_fast, as shown by the KASAN slab use after free report. For the CVSS the PR:L is used because reliable triggering normally requires a local user or virtualization service account that can create, run, and destroy KVM VMs through /dev/kvm, rather than full host administrator privileges. The issue is not directly network reachable and depends on VM lifecycle control plus a race window during destruction. Impact is at least local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.