CVE-2026-72289

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM arm64 vgic component where the vgic prune ap list() function drops ap list lock and irq lock during interrupt migration to another vCPU. Upon reacquiring the locks, the function only verifies if the affinity remains unchanged via vgic target oracle(irq), incorrectly assuming the interrupt is still queued on the vCPU's ap list. If vgic flush pending lpis() removes the interrupt and sets irq->vcpu to NULL while locks are dropped, the affinity check still passes because the interrupt remains enabled and pending. This leads to a second list del() operation on an entry already removed from the list.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.