CVE-2026-98878

What it actually does

The flaw delays the GIC CDEOI priority drop until irq_eoi() completes, so an acknowledged interrupt that triggers a long-running handler (such as software-based VM interrupt injection) keeps the interrupt priority register elevated and prevents any equal- or lower-priority interrupt from being signaled until deactivation occurs.

Why it matters to the business

Systems using GICv5 hardware, especially hypervisors and virtualized workloads, can experience extended periods where new interrupts are ignored, producing apparent system hangs or degraded responsiveness; the issue is only two days old with very low exploit probability so immediate broad outages are unlikely.

How an attack unfolds

An attacker with the ability to generate or control interrupts that invoke lengthy post-ack processing (for example, repeatedly injecting physical interrupts into a guest VM) can hold the priority level high, starving other interrupt sources and achieving a localized denial of service without needing code execution or special privileges beyond normal interrupt generation.

How to fix it

Update to a Linux kernel containing the fix that performs the CDEOI priority drop immediately after interrupt acknowledgment in the GICv5 handler while leaving deactivation in irq_eoi(); rebuild and deploy the kernel on all GICv5 systems, then verify the driver change.

How to confirm the fix worked

Inspect the gic-v5.c source for the relocated CDEOI write immediately after the acknowledgment path and confirm that CDDI deactivation still occurs only inside irq_eoi(); boot the updated kernel and exercise interrupt-heavy workloads to ensure no priority-related stalls occur.

Typical attack path

1. Generate or steer an interrupt to a CPU using GICv5
2. Acknowledge the interrupt in the main handler
3. Enter a long-running software path (VM injection, heavy work) before EOI
4. Observe subsequent equal- or lower-priority interrupts blocked until the slow path finishes

How to detect it

Examine dmesg and kernel logs for GICv5 driver messages around interrupt acknowledgment or EOI timing; monitor hypervisor or guest logs for unusually long interrupt injection latencies; no public exploitation artifacts are known at this time.

What your security team should do

• Track upstream Linux kernel commits for the gic-v5 priority-drop change and schedule testing within the next sprint
• Identify and inventory any GICv5-based platforms or hypervisors in the environment
• Add kernel interrupt-latency monitoring to detect anomalous blocking until the patch is applied