Improper control of a resource through its lifetime in Linux kernel - CVE-2026-80699
Published: August 28, 2026
Vulnerability identifier: #VU146098
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80699
CWE-ID: CWE-664
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state management in KVM arm64 vgic interrupt deactivation logic when handling nested virtual GIC state. A local user can trigger nested interrupt deactivation to cause a denial of service.
The issue affects AmpereOne systems and can cause loss of interrupt pending state and prevent delivery of future interrupts when the highest priority pending interrupt is deactivated while not active.
Affected software
Linux kernel
How to mitigate CVE-2026-80699
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3