CVE-2026-23198

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: Don't clobber irqfd routing type when deassigning irqfd

When deassigning a KVM_IRQFD, don't clobber the irqfd's copy of the IRQ's

routing entry as doing so breaks kvm_arch_irq_bypass_del_producer() on x86

and arm64, which explicitly look for KVM_IRQ_ROUTING_MSI. Instead, to

handle a concurrent routing update, verify that the irqfd is still active

before consuming the routing information. As evidenced by the x86 and

arm64 bugs, and another bug in kvm_arch_update_irqfd_routing() (see below),

clobbering the entry type without notifying arch code is surprising and

error prone.

As a bonus, checking that the irqfd is active provides a convenient

location for documenting _why_ KVM must not consume the routing entry for

an irqfd that is in the process of being deassigned: once the irqfd is

deleted from the list (which happens *before* the eventfd is detached), it

will no longer receive updates via kvm_irq_routing_upd

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References