Cloudanix VulnDB

CVE-2026-98877

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A configuration mistake can make certain Linux systems crash during startup when virtual interrupt features are turned on without the required hardware support.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in irqchip/gic-v4 initialization when kvm-arm.vgic_v4_enable=1 is set on systems lacking a probed ITS, causing kernel panic during __irq_domain_instantiate.

Why it matters to the business

Unexpected system crashes on Linux hosts configured for virtualized interrupt handling, leading to downtime and potential loss of availability in environments relying on KVM with GICv4.

How an attack unfolds

An attacker supplies a malicious kernel command line or boot configuration that enables vgic_v4 on hardware or virtual platforms without an ITS device tree node, triggering the NULL dereference at init time and causing an immediate kernel panic.

How to fix it

Update to a Linux kernel containing the fix that sets vLPI support to false when no ITS is present; ensure kvm-arm.vgic_v4_enable remains disabled on systems without a properly probed ITS.

How to confirm the fix worked

Boot with the parameter set on affected hardware and confirm no panic occurs; inspect kernel logs for gic_domain initialization messages indicating vLPI support is correctly disabled.

Typical attack path

  1. Identify or control boot parameters on a Linux target lacking an MSI-capable ITS
  2. Set kvm-arm.vgic_v4_enable=1 via kernel cmdline or module parameter
  3. Trigger kernel initialization of the GICv4 domain
  4. Cause NULL pointer access leading to panic

How to detect it

Search kernel logs and crash dumps for Unable to handle kernel NULL pointer dereference messages referencing __irq_domain_instantiate together with gic-v4 or vgic_v4_enable references.

  • Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028
  • __irq_domain_instantiate+0x1d4/0x578
  • kvm-arm.vgic_v4_enable=1
  • gic_domain is NULL

What your security team should do

  • Apply the upstream fix in irqchip/gic-v4 immediately on all affected kernels
  • Audit boot configurations to ensure vgic_v4_enable is not enabled without an ITS
  • Monitor kernel oops and panic logs for GICv4 NULL dereference signatures
  • Prioritize patching on virtualization hosts using KVM and GICv4

The record

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting “kvm-arm.vgic_v4_enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gic_domain” is NULL and the kernel attempts to access it. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 Mem abort info: ESR = 0x0000000096000006 CPU: 1 UID: 0 PID: 295 Comm: lkvm-static Not tainted 7.1.0-rc4-ge3f15ad3970e #5 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 81402005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : __irq_domain_instantiate+0x1d4/0x578 lr : __irq_domain_instantiate+0x1cc/0x578 Set vLPI support to false at init time if the host has no ITS, so it propagates properly to kvm_vgic_global_state.has_gicv4.

Affected packages

Ecosystem Package Introduced Fixed