CVE-2024-26598

What it actually does

Use-after-free in KVM arm64 vgic-its LPI translation cache when vgic_its_check_cache returns a vgic_irq without elevating its refcount before releasing the serializing lock, allowing a concurrent DISCARD or similar invalidation to free the object while it is still referenced.

Why it matters to the business

Local attackers on affected arm64 Linux hosts can trigger kernel memory corruption inside KVM, leading to guest VM escape, host crashes, or denial of service that disrupts virtualization workloads.

How an attack unfolds

An attacker with local access on an arm64 Linux system configures a KVM guest that uses the ITS and issues a sequence of ITS commands that creates an LPI translation cache entry; a concurrent DISCARD command then invalidates the entry while the cache-hit path still holds a pointer, resulting in use-after-free during interrupt delivery.

How to fix it

Upgrade the Linux kernel to a version containing commit d04acadb6490aa3314f9c9e087691e55de153b88 or later; rebuild and reboot all affected arm64 systems running KVM.

How to confirm the fix worked

Verify the running kernel contains commit d04acadb6490aa3314f9c9e087691e55de153b88 via git log or kernel version string; attempt to reproduce the race with a proof-of-concept that exercises vgic-its cache invalidation paths.

Typical attack path

1. Obtain local code execution on the arm64 Linux host
2. Create or attach to a KVM guest that exercises the ARM ITS
3. Issue ITS MAPD/MAPI commands to populate the LPI translation cache
4. Race a DISCARD ITS command against cache lookup in vgic_its_check_cache
5. Trigger interrupt delivery that dereferences the freed vgic_irq object

How to detect it

Review kernel logs for vgic-its related warnings, use-after-free reports, or oops traces involving vgic_irq; inspect auditd or syscall logs for unusual ITS device or KVM ioctl activity on arm64 systems.

What your security team should do

• Patch all arm64 Linux hosts running KVM to the fixed commit within the next maintenance window
• Prioritize hosts that expose KVM to untrusted guests or multi-tenant environments
• Monitor kernel changelogs for backports into distribution kernels and apply vendor updates promptly