CVE-2026-80699: Linux Kernel KVM Privilege Escalation Flaw

CVE-2026-80699 Overview

CVE-2026-80699 is a Linux kernel vulnerability in the KVM arm64 virtual generic interrupt controller (vGIC) subsystem. The issue affects nested virtualization scenarios where physical interrupts are already deactivated through the hardware (HW) bit in the list register (LR). An extra deactivation step is performed unnecessarily, which triggers an errata condition on AmpereOne processors. The kernel patch avoids this double-deactivation to prevent interrupt loss on affected hardware.

Critical Impact
On AmpereOne CPUs, deactivating a physical interrupt via ICC_DIR_EL1 or ICC_EOIR1_EL1 that is not active but is the highest priority pending interrupt causes the CPU to lose the pending state and blocks delivery of future interrupts.

Affected Products

Linux kernel with KVM arm64 nested virtualization support
Systems running on AmpereOne processors (hardware errata trigger)
Kernel builds prior to commits 8a570b19b4b1 and f78f08b38a7f

Discovery Timeline

2026-08-28 - CVE-2026-80699 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80699

Vulnerability Analysis

The vulnerability resides in the KVM arm64 vGIC handling logic for nested virtualization. When a virtual machine runs a nested guest, the hypervisor uses the list register HW bit to link virtual interrupts to their physical counterparts. Interrupt deactivation is performed automatically by hardware when the HW bit is set.

The pre-patch code path issued an additional software deactivation of the physical interrupt after the hardware had already handled it. On most Arm implementations this redundant operation is harmless. On AmpereOne CPUs, the redundant deactivation targets an interrupt that is not in the active state, exposing a hardware errata.

Root Cause

The root cause is a logic error in the nested vGIC state machine where the driver did not account for the HW bit already having cleared the physical interrupt's active state. The extra call to the deactivation register (ICC_DIR_EL1 or ICC_EOIR1_EL1 depending on the End-of-Interrupt mode) operates on an interrupt that is pending but not active, which the AmpereOne implementation does not handle safely.

Attack Vector

This is a functional and reliability defect rather than a directly exploitable memory corruption issue. Triggering the condition requires nested KVM virtualization on AmpereOne hardware. The consequence is loss of the interrupt pending state and suppression of subsequent interrupt delivery on the affected CPU, which can lead to guest hangs, missed timer events, or denial of service within nested workloads.

No verified exploit code is available. The vulnerability manifests through normal nested guest interrupt processing on affected hardware. See the upstream fixes at the Kernel Git Commit Reference and the companion commit for the exact code changes.

Detection Methods for CVE-2026-80699

Indicators of Compromise

Nested KVM guests on AmpereOne hardware experiencing stalled or missed interrupts
Guest kernels reporting soft lockups, missed timer ticks, or unresponsive devices
Host dmesg entries related to vGIC state anomalies during nested guest execution

Detection Strategies

Inventory kernel versions across arm64 hosts and identify systems missing commits 8a570b19b4b1 and f78f08b38a7f
Identify AmpereOne-based servers running KVM with nested virtualization enabled (kvm-arm.mode=nested or equivalent)
Review guest workload telemetry for symptoms of interrupt starvation on nested VMs

Monitoring Recommendations

Track kernel changelogs on stable trees for backports of the vGIC nested deactivation fix
Monitor hypervisor and guest logs for interrupt delivery failures and CPU stalls
Correlate hardware model data with kernel version to prioritize patch rollout on Ampere fleets

How to Mitigate CVE-2026-80699

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 8a570b19b4b1 and f78f08b38a7f
Rebuild or upgrade to a distribution kernel that includes the fix on AmpereOne hosts
Prioritize patching hypervisor hosts running nested KVM guests on affected hardware

Patch Information

The fix modifies the KVM arm64 vGIC nested code path to skip the software deactivation when the physical interrupt has already been deactivated through the HW bit in the LR. The patches are available in the mainline and stable Linux kernel trees via the referenced git commits.

Workarounds

Disable nested virtualization (kvm-arm.mode=nvhe or non-nested configuration) on AmpereOne hosts until patches are applied
Migrate nested guest workloads to unaffected arm64 hardware where possible
Restrict administrative access to hypervisor configuration to prevent accidental re-enablement of nested mode

bash

# Verify kernel version and check for the fix
uname -r
git log --oneline v6.x.. -- arch/arm64/kvm/vgic/ | grep -E '8a570b19|f78f08b3'

# Temporarily disable nested KVM on arm64 (requires reboot)
# Edit /etc/default/grub and add to GRUB_CMDLINE_LINUX:
#   kvm-arm.mode=nvhe
update-grub && reboot