From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BEDAE5013C6 for ; Wed, 16 Sep 2026 10:38:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555144; cv=none; b=gtfkf8pdzP3CldXs61EPnmJjWkYsPi7T348UtPhGksF6zZPCG6eM/cmgzaY7DjrWMP2C65MEqDh4pBPoJPAnEOA+dZUHklKrbpUmzxZWfgBuPcVzoHFWFI5Rlj/zWarJwTLjt/PXZGEsbcF6r/lh4x50ZvnqnAcJKPxsZY0CxRM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555144; c=relaxed/simple; bh=TytaPVXNZV7DpdU3kOOave7oNDeYdBYlLaRfaChDvig=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RiNKSvdaWd07t3PAURIb7vtndWeU/JEWPxrYkVQxjaBhzuI6qQnsvaXlSm3k9LfvANjYe+xE5O/0ivVZTE6Qj88U/SK2wPGCoG0qTMouLUDYj2GjJskqu49IUGmwBASI+0fg/OSec9tXMAfgw7JZ1iQtRqt7oCRkqhrwWTj8PJw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=E9btL61F; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="E9btL61F" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 13AB91F0089C; Wed, 16 Sep 2026 10:38:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789555126; bh=tAfd4GgKK7hi3kE/HTK/Qr72iwqRH5MXZy4pvVOVxXc=; h=From:To:Cc:Subject:Date:Reply-To; b=E9btL61FFcMmMSiSoc8HJ57FeoDaoFzBCGirosTiwNHH2hOvbPTzHgxj8P+RrSSUM 3/rnO2b7ao6BcxB/eCrAllRLQT0XMFCpS4YbfLBw88TpPwlB2KgmYxZLQnhMQNtl0A Vg8h91JjpX8+glB0MeBPrfuyzmr+qSuZzHS2AK4Y= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables Date: Wed, 16 Sep 2026 11:30:43 +0100 Message-ID: <2026091641-CVE-2026-89913-e287@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3064; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=1RugHidfIBU327yrBELMQir1j7ITvyoSnfGyOLV6rvM=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmr8qce+rXbneG8E5vs8XsCX89/Z5prHHbHbsemoNj0j R2njBZd7YhlYRBkYpAVU2T5so3n6P6KQ4pehranYeawMoEMYeDiFICJCLMzzA+sDCziumLDzxUu eN/Vi9No44ybYQzz404fvNU5bUPg4sQVP6secMyt+RH0HQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables vgic_v3_save_pending_tables() iterates dist->lpi_xa using xa_for_each() and dereferences the returned struct vgic_irq in the loop body without holding a reference on the LPI. The xarray iterator only provides temporary RCU coverage while looking up the current entry. That is not sufficient for this loop body, which reads fields from struct vgic_irq and performs guest memory accesses before the iteration completes. A concurrent path can trigger this race: the irqfd cached injection path (vgic_its_inject_cached_translation) obtains a transient LPI reference via vgic_its_check_cache() without holding kvm->lock, vcpu->mutex, config_lock, or its_lock. If guest ITS DISCARD then drops the cache and ITE references under its_lock, the transient inject reference may become the final one. When vgic_put_irq() drops it, the LPI is erased from lpi_xa and freed via kfree_rcu(). Meanwhile, vgic_v3_save_pending_tables() may still hold a stale pointer obtained from the xarray iterator and dereference it after the RCU grace period completes. Fix this by re-fetching each iterated LPI via vgic_get_irq(), which takes a stable reference, and dropping it with vgic_put_irq() on all paths. This matches the pattern already used by other lpi_xa iterators in the vgic ITS code. The Linux kernel CVE team has assigned CVE-2026-89913 to this issue. Affected and fixed versions =========================== Fixed in 6.18.51 with commit 7631f95297560157d3a9283cb999e3be00103348 Fixed in 7.2.5 with commit d3a2d20b7248ea67465af1cf79c79f90ff70926c Fixed in 7.3-rc1 with commit f5b8f203bfc07a5a257dff859e66d2c500f9f509 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89913 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/arm64/kvm/vgic/vgic-v3.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/7631f95297560157d3a9283cb999e3be00103348 https://git.kernel.org/stable/c/d3a2d20b7248ea67465af1cf79c79f90ff70926c https://git.kernel.org/stable/c/f5b8f203bfc07a5a257dff859e66d2c500f9f509