SB2026082867 - Improper control of a resource through its lifetime in Linux kernel kvm vgic

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80699)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in KVM arm64 vgic interrupt deactivation logic when handling nested virtual GIC state. A local user can trigger nested interrupt deactivation to cause a denial of service.

The issue affects AmpereOne systems and can cause loss of interrupt pending state and prevent delivery of future interrupts when the highest priority pending interrupt is deactivated while not active.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8a570b19b4b16a8a3b5ffa2b332bd5613110b2d8
• https://git.kernel.org/stable/c/f78f08b38a7f121c7d6b3e41002d9de7fd3c9189