Linux Kernel KVM hypervisor Vulnerability Rated 7.1 CVSS

Last refreshed2026-10-15

Status: UPDATED | Advisory ID: CVE-2026-89912

Key Details

CVE	CVE-2026-89912
CVSS Score / Version	7.1 (High) / CVSS v3.1
Updated	2026-10-15
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is none; user interaction is none; scope is changed; confidentiality impact is none; integrity impact is none; availability impact is high.
Affected products	Linux Kernel
Exploitation prediction (EPSS)	0.18% probability of exploitation in the next 30 days (7% percentile) -- FIRST.org's EPSS model.

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save

MAPC with V=0 drops ite->collection but leaves the ITE on the device's

ITT list, and vgic_its_save_ite() dereferences it unconditionally. A

guest that issues MAPD, MAPTI and then MAPC(V=0) therefore oopses the

host when the VMM issues KVM_DEV_ARM_ITS_SAVE_TABLES to migrate it.

That sequence is UNPREDICTABLE per the architecture, but KVM already

handles the resulting state in the translate, MOVI and DISCARD paths.

Save a zeroed entry, which vgic_its_restore_ite() reads back as

invalid. Skipping the ITE instead would leave the ITT slot holding

whatever is in guest memory, and restore rejects an entry naming a

collection the restored collection table does not have. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-89912
CVE	https://www.cve.org/CVERecord?id=CVE-2026-89912

Source

Reference

NVD

CVE