CVE-2026-89727

A flaw was found in the Kernel-based Virtual Machine (KVM) for ARM64 (arm64) architecture. A malicious guest operating system can provide an interrupt ID (INTID) that is outside the expected range to the GICv2 (Generic Interrupt Controller version 2) during interrupt deactivation. This can trigger a warning condition in the host kernel, potentially leading to a host system crash and resulting in a Denial of Service (DoS) for the host.

A guest controlled out-of-range INTID written to GICV_DIR can make vgic_get_vcpu_irq return NULL in the KVM arm64 GICv2 deactivate path. The old code treated this as an impossible condition and reached WARN_ON_ONCE, which can panic the host when panic_on_warn is enabled. For the CVSS the PR:L is chosen because the attacker needs control over a guest VM or guest code path, but does not need administrative privileges on the host. The issue is not network reachable and is triggered through the virtual interrupt controller interface rather than packet traffic. Impact is denial of service against the host via kernel panic. No confidentiality or integrity impact is assigned because the patch shows a reachable warning and NULL lookup handling issue, not a UAF, OOB access, or write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.