Cloudanix VulnDB

CVE-2026-89727

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel lets a virtual machine on ARM hardware crash the entire physical computer it runs on.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

A guest can write an out-of-range INTID to GICV_DIR with EOImode==1, causing vgic_v2_deactivate to pass a NULL lookup result to vgic_get_vcpu_irq and hit WARN_ON_ONCE, which may panic the host when panic_on_warn is set.

Why it matters to the business

ARM64 hosts running KVM may suffer sudden crashes that take down all virtual machines on the system, producing unplanned downtime and potential data loss for production workloads.

How an attack unfolds

An attacker who controls a guest VM writes an INTID outside the implemented SGI/PPI/SPI ranges into GICV_DIR while EOImode==1; the host kernel treats the failed lookup as impossible, emits a warning, and panics if configured to do so.

How to fix it

Apply the upstream kernel commit that removes the WARN_ON_ONCE call in vgic_v2_deactivate; rebuild and reboot affected ARM64 KVM hosts with the corrected kernel.

How to confirm the fix worked

Confirm the patched kernel source lacks the WARN_ON_ONCE in vgic_v2_deactivate; test by attempting an invalid INTID write from a guest and verify no warning or panic occurs.

Typical attack path

  1. Obtain code execution inside a guest VM
  2. Write an out-of-range INTID value to the GICV_DIR register with EOImode enabled
  3. Trigger the WARN_ON_ONCE path that may panic the host

How to detect it

Inspect host kernel logs (dmesg/syslog) on ARM64 systems for warnings emitted from vgic_v2_deactivate or GICV_DIR handling.

What your security team should do

  • Prioritize kernel updates on all ARM64 KVM hosts
  • Disable panic_on_warn on virtualization hosts until patched
  • Audit guest workloads for unexpected privilege that could be used to trigger the condition

The record

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID vgic_v2_deactivate() passes the INTID a guest wrote to GICV_DIR straight to vgic_get_vcpu_irq(), and treats a failed lookup as a "can't happen" condition with WARN_ON_ONCE(). The guest can make it happen at will, though: for any INTID outside of the implemented SGI, PPI and SPI ranges the lookup returns NULL, since GICv2 has no LPIs. A guest running with EOImode==1 writing such an INTID to GICV_DIR triggers the WARN, and panics hosts running with panic_on_warn. Drop the WARN and ignore failed lookups.

Affected packages

Ecosystem Package Introduced Fixed