CVE-2026-74568

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic: Fix race between LPI release and re-registration

Fix a potential race between decrementing an LPI's reference count and

evicting that structure from the LPI xarray.

LPI structures are maintained in the VGIC LPI xarray (dist->lpi_xa).

When the reference count of an LPI structure drops to zero,

vgic_release_lpi_locked() removes the structure from the xarray and

frees it under the xarray lock.

However, the release of an LPI can race with a concurrent LPI

re-registration with the same INTID via vgic_add_lpi() on another CPU,

since the reference count drop and the xarray eviction are not performed

in a single atomic step. This can happen e.g. if the guest issues a

DISCARD while the LPI is still referenced from a vCPU's active-pending

list (ap_list), and the same INTID is re-mapped via MAPTI.

Particularly, vgic_release_lpi_locked() is called from two distinct

paths: direct release via vgic_put_irq(), a

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References