CVE-2026-89912

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM arm64 vgic-its component where the vgic its save ite() function unconditionally dereferences a NULL collection. This occurs when a guest issues a sequence of MAPD, MAPTI, and MAPC (with V=0) operations, which drops the ite->collection while leaving the Interrupt Translation Entry (ITE) on the device's Interrupt Translation Table (ITT) list. Consequently, the host may experience an oops when the Virtual Machine Monitor (VMM) issues KVM DEV ARM ITS SAVE TABLES during migration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.