SB2026102443 - Incorrect behavior order in Linux kernel irqchip driver

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect behavior order (CVE-ID: CVE-2026-98878)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by blocking other incoming interrupts.

The vulnerability exists due to incorrect ordering of interrupt priority drop operations in the Linux kernel GICv5 interrupt controller driver when an interrupt remains active during a long-running process or guest VM execution. A local user can cause an interrupt to remain active during such execution to delay the priority drop and prevent other interrupts from being signalled.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/abf60331ebe9a9a7937a72aac7699c2907ab9307
• https://git.kernel.org/stable/c/c29bb5acd0cad0b49399d1399dd1bacb39e41438