CVE-2026-98712

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98712", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.365Z", "datePublished": "2026-10-18T15:46:44.857Z", "dateUpdated": "2026-10-19T09:24:23.386Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:24:23.386Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq\n\nReferencing the last interrupt inserted in an LR is rather fragile, as\nthis interrupt can vanish if a concurrently unmapped LPI.\n\nSolve this by bumping up the refcount on the interrupt when populating\nlast_lr_irq, and drop it at vgic_prune_ap_list() time, when LPIs are\nbeing reclaimed."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/vgic/vgic.c"], "versions": [{"version": "6da5e537f5afe091658e846da1949d7e557d2ade", "lessThan": "8b25393d16a5ca8df907bd7ee1ff2e9d85678b3c", "status": "affected", "versionType": "git"}, {"version": "6da5e537f5afe091658e846da1949d7e557d2ade", "lessThan": "19bc5d79ece613f242b5ec03921a3b465321bfed", "status": "affected", "versionType": "git"}, {"version": "cd28ca4c27ed5929f61bbed8a967c20519facb88", "status": "affected", "versionType": "git"}, {"version": "6.19.9", "lessThan": "6.20", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/vgic/vgic.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8b25393d16a5ca8df907bd7ee1ff2e9d85678b3c"}, {"url": "https://git.kernel.org/stable/c/19bc5d79ece613f242b5ec03921a3b465321bfed"}], "title": "KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/arm64/kvm/vgic/vgic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8b25393d16a5ca8df907bd7ee1ff2e9d85678b3c", "status": "affected", "version": "6da5e537f5afe091658e846da1949d7e557d2ade", "versionType": "git"}, {"lessThan": "19bc5d79ece613f242b5ec03921a3b465321bfed", "status": "affected", "version": "6da5e537f5afe091658e846da1949d7e557d2ade", "versionType": "git"}, {"status": "affected", "version": "cd28ca4c27ed5929f61bbed8a967c20519facb88", "versionType": "git"}, {"lessThan": "6.20", "status": "affected", "version": "6.19.9", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/arm64/kvm/vgic/vgic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq\n\nReferencing the last interrupt inserted in an LR is rather fragile, as\nthis interrupt can vanish if a concurrently unmapped LPI.\n\nSolve this by bumping up the refcount on the interrupt when populating\nlast_lr_irq, and drop it at vgic_prune_ap_list() time, when LPIs are\nbeing reclaimed."}], "id": "CVE-2026-98712", "lastModified": "2026-10-19T10:19:35.477", "metrics": {}, "published": "2026-10-18T16:17:24.760", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/19bc5d79ece613f242b5ec03921a3b465321bfed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8b25393d16a5ca8df907bd7ee1ff2e9d85678b3c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq", "id": "2555054", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555054"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq\nReferencing the last interrupt inserted in an LR is rather fragile, as\nthis interrupt can vanish if a concurrently unmapped LPI.\nSolve this by bumping up the refcount on the interrupt when populating\nlast_lr_irq, and drop it at vgic_prune_ap_list() time, when LPIs are\nbeing reclaimed.", "A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for ARM64. The virtual interrupt controller fails to maintain an appropriate reference count on active interrupts, allowing them to be reclaimed and freed while still in use. A malicious guest user could exploit this issue during concurrent interrupt unmapping to trigger a use-after-free condition, resulting in a Denial of Service (DoS) by crashing the host system."], "name": "CVE-2026-98712", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98712\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98712\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98712.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6da5e537f5afe091658e846da1949d7e557d2ade,8b25393d16a5ca8df907bd7ee1ff2e9d85678b3c]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6da5e537f5afe091658e846da1949d7e557d2ade,19bc5d79ece613f242b5ec0391a3b465321bfed]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd28ca4c27ed5929f61bbed8a967c20519facb88,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.19.9,6.20)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.10,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T19:30:14.462427+00:00", "updated": "2026-10-23T07:45:17.027694+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}