CVE-2026-89727: Linux Kernel GICv2 DOS Vulnerability

CVE-2026-89727 Overview

CVE-2026-89727 is a Linux kernel vulnerability in the KVM (Kernel-based Virtual Machine) subsystem for arm64 platforms. The flaw resides in the GICv2 (Generic Interrupt Controller version 2) virtualization layer, specifically in vgic_v2_deactivate(). A guest virtual machine can write an out-of-range interrupt identifier (INTID) to the GICV_DIR register, causing the host kernel to trigger a WARN_ON_ONCE(). On hosts configured with panic_on_warn, this results in a kernel panic and host denial of service.

Critical Impact
An unprivileged guest running with EOImode==1 can panic the host hypervisor by writing arbitrary INTIDs to GICV_DIR, breaking multi-tenant isolation on affected arm64 systems.

Affected Products

Linux kernel with KVM arm64 GICv2 virtualization support
Arm64 hosts running virtual machines with panic_on_warn enabled
Stable kernel branches prior to the commits referenced in the fix

Discovery Timeline

2026-09-11 - CVE-2026-89727 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89727

Vulnerability Analysis

The vulnerability exists in the virtual GICv2 (vGICv2) handling code for KVM on arm64. When a guest writes to the GICV_DIR register to deactivate an interrupt, the function vgic_v2_deactivate() forwards the guest-supplied INTID directly to vgic_get_vcpu_irq() without prior range validation. The helper returns NULL for any INTID outside the implemented SGI (Software Generated Interrupt), PPI (Private Peripheral Interrupt), and SPI (Shared Peripheral Interrupt) ranges, since GICv2 does not implement LPIs (Locally-generated Peripheral Interrupts).

The original code treated this NULL return as a "can't happen" invariant and used WARN_ON_ONCE() to flag it. In practice, the guest fully controls the value written to GICV_DIR, so this invariant is trivially violated. Hosts booted with the panic_on_warn kernel parameter convert the warning into a full kernel panic, giving a guest a reliable primitive to crash the hypervisor. This maps to a guest-triggered denial of service against the host [CWE-617: Reachable Assertion].

Root Cause

The root cause is missing input validation on a guest-controlled register value. vgic_v2_deactivate() assumed the INTID had already been sanitized before reaching the deactivation path. The WARN_ON_ONCE() was intended as a debugging aid for kernel developers, not as a defense against hostile guest input. Combined with panic_on_warn, this misuse of an assertion for a reachable code path exposes the host to guest-initiated denial of service.

Attack Vector

Exploitation requires the ability to run code inside a KVM guest on an affected arm64 host. The guest configures its interrupt controller in EOImode==1 and writes any INTID outside the SGI, PPI, or SPI ranges to GICV_DIR. The trapped MMIO write reaches vgic_v2_deactivate(), the lookup returns NULL, and WARN_ON_ONCE() fires. On hardened hosts with panic_on_warn set, the kernel panics and terminates all workloads. No host authentication or elevated guest privileges are required beyond normal guest kernel access to interrupt controller registers.

No public proof-of-concept code has been released. Technical details are available in the upstream fix commits referenced by the Kernel Git Commit Update and the companion stable backport.

Detection Methods for CVE-2026-89727

Indicators of Compromise

Unexpected host kernel panics on arm64 KVM hypervisors coinciding with guest activity
Kernel log entries referencing vgic_v2_deactivate or vgic_get_vcpu_irq prior to a panic
WARN_ON_ONCE splats in dmesg mentioning vGIC INTID lookup failures
Correlated guest workload crashes across all VMs on a single host at the same timestamp

Detection Strategies

Aggregate dmesg and kmsg output from arm64 KVM hosts into a central log platform and alert on vgic_v2 warnings
Monitor for host reboots that correlate with guest VM lifecycle events, particularly on multi-tenant infrastructure
Track kernel version inventory across arm64 hypervisor fleets to identify unpatched hosts

Monitoring Recommendations

Enable persistent kernel crash dump capture (kdump) to preserve evidence when panic_on_warn fires
Track hypervisor uptime metrics and alert on unexpected host restarts in virtualization clusters
Review guest images and untrusted tenants for kernel modules that manipulate GIC registers directly

How to Mitigate CVE-2026-89727

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits 78b95c571d02 and c6d9c8ac6521
Inventory arm64 KVM hosts and prioritize patching systems configured with panic_on_warn
Restrict guest VM deployment to trusted tenants on unpatched arm64 hypervisors until patching completes

Patch Information

The fix removes the WARN_ON_ONCE() in vgic_v2_deactivate() and treats failed vgic_get_vcpu_irq() lookups as an expected condition, silently ignoring out-of-range INTIDs written to GICV_DIR. See the upstream Kernel Git Commit Update and the stable branch backport for the exact code changes. Distribution vendors are expected to ship the fix in subsequent stable kernel releases.

Workarounds

Disable panic_on_warn on arm64 KVM hosts to prevent guest-triggered warnings from escalating to full host panics
Limit guest access to sensitive interrupt controller MMIO regions through hypervisor configuration where feasible
Migrate critical workloads off unpatched arm64 hypervisors that host untrusted guests

bash

# Check whether panic_on_warn is enabled on the host
sysctl kernel.panic_on_warn

# Temporarily disable panic_on_warn as a stopgap until patching
sysctl -w kernel.panic_on_warn=0

# Verify the running kernel version against patched stable releases
uname -r