CVE-2026-89912: Linux Kernel KVM ARM64 Privilege Escalation

CVE-2026-89912 Overview

CVE-2026-89912 is a NULL pointer dereference in the Linux kernel's KVM arm64 virtual generic interrupt controller (vGIC) Interrupt Translation Service (ITS) implementation. The vgic_its_save_ite() function dereferences ite->collection without checking whether it is NULL. A guest can reach this state by issuing an ITS MAPD, MAPTI, and then MAPC with V=0, which drops the collection reference while leaving the Interrupt Translation Table (ITT) entry in place. When the Virtual Machine Monitor (VMM) later calls KVM_DEV_ARM_ITS_SAVE_TABLES to migrate the guest, the host kernel oopses.

Critical Impact
An unprivileged guest on an arm64 host can trigger a host kernel oops during live migration, denying service to every workload sharing that hypervisor.

Affected Products

Linux kernel on arm64 with KVM and vGIC ITS emulation enabled
Stable kernel branches receiving the fix commits 36df3688, 3d4c26b1, and c6c156d9
Any hypervisor host exposing GICv3 ITS to guests via KVM

Discovery Timeline

2026-09-16 - CVE-2026-89912 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89912

Vulnerability Analysis

The Linux KVM arm64 vGIC ITS code models per-device Interrupt Translation Tables that map guest event IDs to LPIs and collections. The MAPC command associates a collection ID with a redistributor. When the guest issues MAPC with the valid bit V=0, the ITS code clears ite->collection but does not remove the ITE from the device's ITT list.

When the VMM later invokes KVM_DEV_ARM_ITS_SAVE_TABLES to serialize ITS state for migration, vgic_its_save_ite() walks the ITT list and dereferences ite->collection unconditionally. The NULL dereference triggers a kernel oops in host context. The architecture defines the MAPD → MAPTI → MAPC(V=0) sequence as UNPREDICTABLE, but existing translate, MOVI, and DISCARD paths already tolerate the resulting state, so the save path must do the same.

Root Cause

The root cause is a missing NULL check on ite->collection inside vgic_its_save_ite(). State transitions performed by MAPC(V=0) leave the ITT entry in a partially valid form that the save path does not anticipate. The fix, applied in commits 36df368861d2, 3d4c26b16a04, and c6c156d931c3, writes a zeroed entry that vgic_its_restore_ite() reads back as invalid, preserving ITT slot ordering while rejecting stale collection references on restore.

Attack Vector

Exploitation requires local access to issue ITS commands from within a KVM guest on an arm64 host. A guest with the ability to program the ITS submits MAPD, MAPTI, and MAPC with V=0, then waits for the VMM to trigger a table save, typically during live migration or snapshotting. The resulting NULL dereference crashes the host kernel and terminates every co-tenant workload.

No public proof-of-concept exploit code is available. The reproducer follows directly from the sequence described in the upstream commit message.

Detection Methods for CVE-2026-89912

Indicators of Compromise

Kernel oops or panic messages referencing vgic_its_save_ite in dmesg or the serial console on arm64 KVM hosts
Host crashes correlated with KVM_DEV_ARM_ITS_SAVE_TABLES ioctl calls issued by qemu-system-aarch64 or libvirtd
Failed or aborted live migrations of arm64 guests immediately preceded by ITS command activity

Detection Strategies

Audit running kernels on arm64 KVM hosts against the fixed commits 36df368861d2, 3d4c26b16a04, and c6c156d931c3 distributed via stable kernel branches
Alert on kernel crash telemetry containing vgic_its symbols in the backtrace
Track VMM ioctl activity to correlate KVM_DEV_ARM_ITS_SAVE_TABLES events with subsequent host instability

Monitoring Recommendations

Forward kdump, kmsg, and hypervisor journal data to a centralized logging pipeline for backtrace analysis
Monitor guest exit patterns for repeated ITS MAPC commands with V=0 followed by save requests
Baseline live migration success rates per host to surface regression clusters caused by guest-induced oopses

How to Mitigate CVE-2026-89912

Immediate Actions Required

Apply the upstream fix commits 36df368861d2, 3d4c26b16a04, and c6c156d931c3 from the stable kernel tree to all arm64 KVM hosts
Restrict live migration and table-save operations on unpatched hosts until the fixed kernel is deployed
Limit guest workloads on unpatched arm64 hypervisors to trusted tenants that cannot issue arbitrary ITS commands

Patch Information

The fix modifies vgic_its_save_ite() to write a zeroed entry when ite->collection is NULL, and updates vgic_its_restore_ite() to treat that entry as invalid. See the upstream stable commits: commit 36df3688, commit 3d4c26b1, and commit c6c156d9.

Workarounds

Disable or defer KVM_DEV_ARM_ITS_SAVE_TABLES operations, including live migration and snapshotting of arm64 guests, until the patch is applied
Where feasible, run arm64 guests with vGIC configurations that do not expose the ITS to guest control
Isolate untrusted guests on hosts that do not participate in migration pools

bash

# Verify the running kernel contains the fix
uname -r
git -C /usr/src/linux log --oneline | grep -E '36df3688|3d4c26b1|c6c156d9'