CVE-2026-89913

A flaw was found in the KVM (Kernel-based Virtual Machine) arm64 vgic-v3 component of the Linux kernel. A race condition exists where the vgic_v3_save_pending_tables() function can dereference a freed vgic_irq structure due to improper handling of LPI (Locality-sensitive Paging Interrupt) references. This could allow a local attacker with access to a virtual machine to cause a denial of service or potentially execute arbitrary code.

A race in KVM arm64 VGICv3 LPI handling can let vgic_v3_save_pending_tables use a stale struct vgic_irq pointer after the LPI was removed from lpi_xa and freed through RCU. The vulnerable path reads LPI fields and performs guest memory operations after only temporary xarray RCU coverage, while a concurrent irqfd cached injection path and guest ITS DISCARD can drop the last LPI reference. For the CVSS the PR:L is used because triggering requires a local user or guest owner with access to a KVM VM or VMM interface rather than full host administrator privileges. The issue is not directly network reachable and is a local virtualization attack surface. Impact is at least denial of service via host kernel crash and in the worst case may allow confidentiality or integrity impact because the bug is a kernel use after free in host context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.