{"apiVersion":"1.0","identifier":"CVE-2026-72288","description":"In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling Hyunwoo Kim reports some really bad races should the following situation occur: - LPI-I is pending in vcpu-B-s AP list - vcpu-A writes to vcpu-B-s RD to disable its LPIs - vcpu-C moves I from B to C If the last two race nicely enough, vgic_prune_ap_list() can drop the irq and AP list locks, reacquire them, and in the interval the irq has been freed. UAF follows. The fix is two-fold: - Before dropping the irq and ap_list locks, take a reference on the irq - Do not try to handle migration of the pending bit: there is no expectation that this state is retained, as per the architecture With that, we-re sure that the interrupt is still around, and we safely remove it from the AP list as it has no target at this stage (unless another interrupt fires, but that-s another story).","publishedAt":"2026-08-15T06:22:00","lastModifiedAt":"2026-08-17T06:18:31","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72288","cvssScore":9.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","epssProbability":0.00178,"riskScore":0.94,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72288","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72288","en":"https://www.redsauce.net/en/cves/CVE-2026-72288","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72288","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72288","de":"https://www.redsauce.net/de/cves/CVE-2026-72288","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72288","el":"https://www.redsauce.net/el/cves/CVE-2026-72288"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72288"}}