CVE-2026-74568

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) for ARM64 systems, specifically within the virtual Generic Interrupt Controller (VGIC). A race condition can occur when a Logical Processor Interrupt (LPI) is released and then re-registered with the same identifier by a guest operating system. This timing issue can lead to either the incorrect deletion of a newly registered LPI or a memory leak, potentially causing system instability or a denial of service.

A race in KVM arm64 VGIC LPI lifetime handling can occur when an LPI refcount reaches zero while another CPU re-registers the same INTID through vgic_add_lpi. The old code could separate the refcount drop from xarray eviction, allowing a newly registered LPI to be erased or an old LPI to be overwritten and leaked. For the CVSS the PR:L is used because an attacker typically needs control of a guest or a guest kernel path able to issue ITS LPI mapping commands, but full host administrative privileges are not required. The issue is not network reachable by packet traffic and is exposed through the KVM guest interrupt controller interface on arm64 systems using VGICv3 ITS and LPIs. Impact is at least availability loss, while the paranoid score uses CIA:HHH due to possible memory corruption consequences from the race class and patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.