CVE-2026-98878

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98878", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.377Z", "datePublished": "2026-10-23T11:37:25.121Z", "dateUpdated": "2026-10-26T06:56:00.811Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-26T06:56:00.811Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v5: Immediately exec priority drop following activate\n\nWith GICv5 an interrupt of equal or lower priority cannot be signalled\nuntil there has been a priority drop. This is done via the GIC CDEOI\nsystem instruction. Once this has been executed, the hardware is able\nto signal the next interrupt if there is one.\n\nAs all interrupts are programmed to have the same priority, no new\ninterrupts can be signalled until the priority drop has happened. This\ncan cause issues when, for example, an interrupt remains active while\na long running process takes place, such as when injecting a physical\ninterrupt into a guest VM in software.\n\nThe GICv5 driver has so far done the priority drop as part of\nirq_eoi(), i.e., at the same time as deactivating the interrupt. This\nmeans that any long running process (or VM) could block incoming\ninterrupts, effectively causing a denial of service for all other\ninterrupts.\n\nRather than doing the EOI as part of irq_eoi() (which the name would\nsuggest would be a good place for it), move it to happen immediately\nafter acknowledging an interrupt in the main GICv5 interrupt\nhandler. The deactivation of interrupts (GIC CDDI) remains implemented\nas part of irq_eoi(), which means that the same interrupt cannot be\nsignalled a second time until deactivated by software."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/irqchip/irq-gic-v5.c"], "versions": [{"version": "7ec80fb3f025825e860b433685fb801d6de34bf3", "lessThan": "c29bb5acd0cad0b49399d1399dd1bacb39e41438", "status": "affected", "versionType": "git"}, {"version": "7ec80fb3f025825e860b433685fb801d6de34bf3", "lessThan": "abf60331ebe9a9a7937a72aac7699c2907ab9307", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/irqchip/irq-gic-v5.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c29bb5acd0cad0b49399d1399dd1bacb39e41438"}, {"url": "https://git.kernel.org/stable/c/abf60331ebe9a9a7937a72aac7699c2907ab9307"}], "title": "irqchip/gic-v5: Immediately exec priority drop following activate", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/irqchip/irq-gic-v5.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c29bb5acd0cad0b49399d1399dd1bacb39e41438", "status": "affected", "version": "7ec80fb3f025825e860b433685fb801d6de34bf3", "versionType": "git"}, {"lessThan": "abf60331ebe9a9a7937a72aac7699c2907ab9307", "status": "affected", "version": "7ec80fb3f025825e860b433685fb801d6de34bf3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/irqchip/irq-gic-v5.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v5: Immediately exec priority drop following activate\n\nWith GICv5 an interrupt of equal or lower priority cannot be signalled\nuntil there has been a priority drop. This is done via the GIC CDEOI\nsystem instruction. Once this has been executed, the hardware is able\nto signal the next interrupt if there is one.\n\nAs all interrupts are programmed to have the same priority, no new\ninterrupts can be signalled until the priority drop has happened. This\ncan cause issues when, for example, an interrupt remains active while\na long running process takes place, such as when injecting a physical\ninterrupt into a guest VM in software.\n\nThe GICv5 driver has so far done the priority drop as part of\nirq_eoi(), i.e., at the same time as deactivating the interrupt. This\nmeans that any long running process (or VM) could block incoming\ninterrupts, effectively causing a denial of service for all other\ninterrupts.\n\nRather than doing the EOI as part of irq_eoi() (which the name would\nsuggest would be a good place for it), move it to happen immediately\nafter acknowledging an interrupt in the main GICv5 interrupt\nhandler. The deactivation of interrupts (GIC CDDI) remains implemented\nas part of irq_eoi(), which means that the same interrupt cannot be\nsignalled a second time until deactivated by software."}], "id": "CVE-2026-98878", "lastModified": "2026-10-26T07:17:12.297", "metrics": {}, "published": "2026-10-23T12:18:21.330", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/abf60331ebe9a9a7937a72aac7699c2907ab9307"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c29bb5acd0cad0b49399d1399dd1bacb39e41438"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: irqchip/gic-v5: Immediately exec priority drop following activate", "id": "2559551", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559551"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nirqchip/gic-v5: Immediately exec priority drop following activate\nWith GICv5 an interrupt of equal or lower priority cannot be signalled\nuntil there has been a priority drop. This is done via the GIC CDEOI\nsystem instruction. Once this has been executed, the hardware is able\nto signal the next interrupt if there is one.\nAs all interrupts are programmed to have the same priority, no new\ninterrupts can be signalled until the priority drop has happened. This\ncan cause issues when, for example, an interrupt remains active while\na long running process takes place, such as when injecting a physical\ninterrupt into a guest VM in software.\nThe GICv5 driver has so far done the priority drop as part of\nirq_eoi(), i.e., at the same time as deactivating the interrupt. This\nmeans that any long running process (or VM) could block incoming\ninterrupts, effectively causing a denial of service for all other\ninterrupts.\nRather than doing the EOI as part of irq_eoi() (which the name would\nsuggest would be a good place for it), move it to happen immediately\nafter acknowledging an interrupt in the main GICv5 interrupt\nhandler. The deactivation of interrupts (GIC CDDI) remains implemented\nas part of irq_eoi(), which means that the same interrupt cannot be\nsignalled a second time until deactivated by software.", "A flaw was found in the Linux kernel's Generic Interrupt Controller version 5 (GICv5) driver. The driver delayed dropping an interrupt's priority until full deactivation rather than immediately after acknowledging it. When an interrupt remains active during a long-running operation or guest virtual machine (VM) execution, the hardware cannot signal new interrupts. This allows a local process or guest VM to block incoming hardware interrupts, resulting in a Denial of Service (DoS) for the system."], "name": "CVE-2026-98878", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98878\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98878\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98878.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c29bb5acd0cad0b49399d1399dd1bacb39e41438)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,abf60331ebe9a9a7937a72aac7699c2907ab9307)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c29bb5acd0cad0b49399d1399dd1bacb39e41438)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,abf60331ebe9a9a7937a72aac7699c2907ab9307)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T14:30:13.403361+00:00", "updated": "2026-10-27T09:15:18.904260+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-760", "CWE-772"]}