1. Home
  2. Vulnerabilities
  3. CVE-2026-72288
9.3
CRITICAL CVSS 3.1
CVE-2026-72288
KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling Hyunwoo Kim reports some really bad races should the following situation occur: - LPI-I is pending in vcpu-B's AP list - vcpu-A writes to vcpu-B's RD to disable its LPIs - vcpu-C moves I from B to C If the last two race nicely enough, vgic_prune_ap_list() can drop the irq and AP list locks, reacquire them, and in the interval the irq has been freed. UAF follows. The fix is two-fold: - Before dropping the irq and ap_list locks, take a reference on the irq - Do not try to handle migration of the pending bit: there is no expectation that this state is retained, as per the architecture With that, we're sure that the interrupt is still around, and we safely remove it from the AP list as it has no target at this stage (unless another interrupt fires, but that's another story).

Details
INFO

Published Date :

Aug. 15, 2026, 6:22 a.m.

Last Modified :

Aug. 17, 2026, 6:18 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-72288 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Address race conditions by referencing interrupts before dropping locks and handling interrupt migration.
  • Reference interrupts before dropping locks.
  • Do not handle migration of pending interrupt bits.
  • Update the Linux kernel to the latest version.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-72288.

URL Resource
https://git.kernel.org/stable/c/7258770e5814f15e8308ebda82ac9acf6964ba8e
https://git.kernel.org/stable/c/b1a89d12d35a8256d2b170ced0b1c86851f3def2
https://git.kernel.org/stable/c/d19dca8194ebed371e624331c6be2cb73b562caf
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-72288 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-72288 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-72288 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-72288 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5dd4b924e390af426e424d5e52c1b4d1566af817', 'lessThan': 'd19dca8194ebed371e624331c6be2cb73b562caf', 'versionType': 'git'}, {'status': 'affected', 'version': '5dd4b924e390af426e424d5e52c1b4d1566af817', 'lessThan': 'b1a89d12d35a8256d2b170ced0b1c86851f3def2', 'versionType': 'git'}, {'status': 'affected', 'version': '5dd4b924e390af426e424d5e52c1b4d1566af817', 'lessThan': '7258770e5814f15e8308ebda82ac9acf6964ba8e', 'versionType': 'git'}], 'programFiles': ['arch/arm64/kvm/vgic/vgic.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.8'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.8', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc4', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/arm64/kvm/vgic/vgic.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5dd4b924e390af426e424d5e52c1b4d1566af817', 'lessThan': 'd19dca8194ebed371e624331c6be2cb73b562caf', 'versionType': 'git'}, {'status': 'affected', 'version': '5dd4b924e390af426e424d5e52c1b4d1566af817', 'lessThan': 'b1a89d12d35a8256d2b170ced0b1c86851f3def2', 'versionType': 'git'}, {'status': 'affected', 'version': '5dd4b924e390af426e424d5e52c1b4d1566af817', 'lessThan': '7258770e5814f15e8308ebda82ac9acf6964ba8e', 'versionType': 'git'}], 'programFiles': ['arch/arm64/kvm/vgic/vgic.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.8'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.8', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/arm64/kvm/vgic/vgic.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5dd4b924e390af426e424d5e52c1b4d1566af817', 'lessThan': 'd19dca8194ebed371e624331c6be2cb73b562caf', 'versionType': 'git'}, {'status': 'affected', 'version': '5dd4b924e390af426e424d5e52c1b4d1566af817', 'lessThan': 'b1a89d12d35a8256d2b170ced0b1c86851f3def2', 'versionType': 'git'}, {'status': 'affected', 'version': '5dd4b924e390af426e424d5e52c1b4d1566af817', 'lessThan': '7258770e5814f15e8308ebda82ac9acf6964ba8e', 'versionType': 'git'}], 'programFiles': ['arch/arm64/kvm/vgic/vgic.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.8'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.8', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc4', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/arm64/kvm/vgic/vgic.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling Hyunwoo Kim reports some really bad races should the following situation occur: - LPI-I is pending in vcpu-B's AP list - vcpu-A writes to vcpu-B's RD to disable its LPIs - vcpu-C moves I from B to C If the last two race nicely enough, vgic_prune_ap_list() can drop the irq and AP list locks, reacquire them, and in the interval the irq has been freed. UAF follows. The fix is two-fold: - Before dropping the irq and ap_list locks, take a reference on the irq - Do not try to handle migration of the pending bit: there is no expectation that this state is retained, as per the architecture With that, we're sure that the interrupt is still around, and we safely remove it from the AP list as it has no target at this stage (unless another interrupt fires, but that's another story).
    Added Reference https://git.kernel.org/stable/c/7258770e5814f15e8308ebda82ac9acf6964ba8e
    Added Reference https://git.kernel.org/stable/c/b1a89d12d35a8256d2b170ced0b1c86851f3def2
    Added Reference https://git.kernel.org/stable/c/d19dca8194ebed371e624331c6be2cb73b562caf
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 9.3
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact