CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers

CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers

kvm_io_bus_get_dev() returns a device that is only matched by the
address, and nothing else. This can cause a lifetime issue if
the matched device is not the expected type, as by the time
the caller can introspect the object, it might be gone (the srcu
lock having been dropped).

Given that there is only a single user of this helper, the simplest
option is to move the locking responsibility to the caller, which
can keep the srcu lock held for as long as it wants.

Note that this aligns with other kvm_io_bus*() helpers, which
already require the srcu lock to be held by the callers.

The Linux kernel CVE team has assigned CVE-2026-72282 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.8 with commit 8a39d00670f0792c1186e442e1dd28fe0326f2ee and fixed in 5.10.261 with commit f398b7d92cd999191249830b9171c9bd787a9a91
	Issue introduced in 4.8 with commit 8a39d00670f0792c1186e442e1dd28fe0326f2ee and fixed in 5.15.212 with commit 1b4a3c2f0509e7b0e65667f3c36676a849ee2755
	Issue introduced in 4.8 with commit 8a39d00670f0792c1186e442e1dd28fe0326f2ee and fixed in 6.1.178 with commit cfe107b02a3c3f049e0dc15b6a36625f048eda2a
	Issue introduced in 4.8 with commit 8a39d00670f0792c1186e442e1dd28fe0326f2ee and fixed in 6.6.145 with commit 90d35d2b8e47afd68fe2a4dd0eeb60bc71641775
	Issue introduced in 4.8 with commit 8a39d00670f0792c1186e442e1dd28fe0326f2ee and fixed in 6.12.97 with commit e01071ea006c9b952125ed8b0cc90ac7bd356cce
	Issue introduced in 4.8 with commit 8a39d00670f0792c1186e442e1dd28fe0326f2ee and fixed in 6.18.40 with commit 7099e7148f81c605bbc319b16ce0131540341560
	Issue introduced in 4.8 with commit 8a39d00670f0792c1186e442e1dd28fe0326f2ee and fixed in 7.1.5 with commit 0cbae0e296d27ce4c4cce83e34d40c2bfd8133aa
	Issue introduced in 4.8 with commit 8a39d00670f0792c1186e442e1dd28fe0326f2ee and fixed in 7.2-rc4 with commit 3a07249981629ace483ebbef81ef6b34c2d2afec

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72282
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/arm64/kvm/vgic/vgic-its.c
	virt/kvm/kvm_main.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f398b7d92cd999191249830b9171c9bd787a9a91
	https://git.kernel.org/stable/c/1b4a3c2f0509e7b0e65667f3c36676a849ee2755
	https://git.kernel.org/stable/c/cfe107b02a3c3f049e0dc15b6a36625f048eda2a
	https://git.kernel.org/stable/c/90d35d2b8e47afd68fe2a4dd0eeb60bc71641775
	https://git.kernel.org/stable/c/e01071ea006c9b952125ed8b0cc90ac7bd356cce
	https://git.kernel.org/stable/c/7099e7148f81c605bbc319b16ce0131540341560
	https://git.kernel.org/stable/c/0cbae0e296d27ce4c4cce83e34d40c2bfd8133aa
	https://git.kernel.org/stable/c/3a07249981629ace483ebbef81ef6b34c2d2afec