CVE-2026-89913 Overview
CVE-2026-89913 is a use-after-free vulnerability in the Linux kernel's KVM subsystem, specifically within the ARM64 GICv3 (Generic Interrupt Controller v3) virtualization code. The flaw resides in vgic_v3_save_pending_tables(), which iterates the dist->lpi_xa xarray using xa_for_each() and dereferences the returned struct vgic_irq without holding a stable reference on the Locality-specific Peripheral Interrupt (LPI). A concurrent irqfd cached injection path can race with an ITS DISCARD operation, causing the LPI to be freed via kfree_rcu() while vgic_v3_save_pending_tables() still holds a stale pointer.
Critical Impact
A local attacker with guest privileges can trigger a race condition leading to a use-after-free in host kernel memory, potentially enabling host kernel compromise from a KVM guest.
Affected Products
- Linux kernel with KVM ARM64 support
- Systems using GICv3 interrupt controller virtualization
- KVM guests configured with LPI/ITS emulation
Discovery Timeline
- 2026-09-16 - CVE-2026-89913 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-89913
Vulnerability Analysis
The vulnerability is a race condition leading to use-after-free [CWE-416] in the ARM64 KVM vGIC-v3 implementation. The vgic_v3_save_pending_tables() function walks the LPI xarray to persist pending interrupt state to guest memory. Its iteration relies only on the transient RCU coverage provided by xa_for_each() during entry lookup, which does not extend to the loop body. Inside the loop, the code reads fields from struct vgic_irq and issues guest memory accesses, both of which outlive that RCU window.
Because the loop body does not take an explicit LPI reference, another CPU can drop the last reference and free the vgic_irq while it is still in use. The stale pointer is then dereferenced after the RCU grace period completes, producing memory corruption or a controllable use-after-free.
Root Cause
The root cause is missing reference counting on struct vgic_irq objects during xarray iteration. The xa_for_each() macro provides RCU protection only while locating the next entry, not while the caller operates on it. The fix re-fetches each iterated LPI via vgic_get_irq() to acquire a stable reference and releases it with vgic_put_irq() on all exit paths, matching the pattern used by other lpi_xa iterators in the vGIC ITS code.
Attack Vector
Exploitation requires local access with the ability to run a KVM guest and drive its virtual GIC. An attacker races two paths: the irqfd cached injection path (vgic_its_inject_cached_translation), which obtains a transient LPI reference via vgic_its_check_cache() without holding kvm->lock, vcpu->mutex, config_lock, or its_lock; and a guest-issued ITS DISCARD command that drops the cache and ITE references under its_lock. When the transient inject reference becomes the final one and vgic_put_irq() frees the LPI via kfree_rcu(), a concurrently running vgic_v3_save_pending_tables() operates on freed memory.
No verified public exploit code is available. Refer to the upstream commits listed under Patch Information for the authoritative technical fix.
Detection Methods for CVE-2026-89913
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing vgic_v3_save_pending_tables, vgic_get_irq, or vgic_put_irq in dmesg or journalctl -k.
- KASAN reports flagging use-after-free reads on struct vgic_irq allocations on ARM64 KVM hosts.
- Guest VM save, migrate, or snapshot operations correlating with host kernel instability on GICv3 systems.
Detection Strategies
- Enable KASAN and lockdep on ARM64 KVM hosts in test environments to surface racing accesses to LPI structures.
- Monitor host kernel logs for warnings and stack traces originating from the arch/arm64/kvm/vgic code paths.
- Correlate guest ITS command activity (DISCARD, MAPI, MAPTI) with host-side crash telemetry to identify potential exploitation attempts.
Monitoring Recommendations
- Forward host kernel logs and crash dumps to a centralized logging platform for retention and correlation.
- Alert on repeated KVM subsystem faults from the same guest or workload, which may indicate race exploitation attempts.
- Track host uptime and unexpected reboots on virtualization hosts running untrusted guest workloads.
How to Mitigate CVE-2026-89913
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 7631f95, d3a2d20, and f5b8f20 as soon as your distribution ships them.
- Restrict KVM guest creation on ARM64 GICv3 hosts to trusted tenants until patched kernels are deployed.
- Audit which ARM64 virtualization hosts expose GICv3 ITS emulation to guests and prioritize patching multi-tenant systems.
Patch Information
The fix takes an LPI reference via vgic_get_irq() inside the vgic_v3_save_pending_tables() iteration and releases it with vgic_put_irq() on all paths. See the upstream commits: Kernel Git Commit 7631f95, Kernel Git Commit d3a2d20, and Kernel Git Commit f5b8f20. Track your Linux distribution's security advisories for backported stable kernel releases.
Workarounds
- No supported runtime workaround exists; patching the host kernel is required to remediate the race.
- Where patching is delayed, limit exposure by avoiding untrusted guest workloads on ARM64 KVM hosts that use GICv3 ITS emulation.
- Disable or avoid guest configurations that rely on LPI/ITS emulation where operationally feasible until patched kernels are installed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.