CVE-2026-80699 KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context
A flaw in Linux KVM arm64 nested virtualization on AmpereOne CPUs allows a guest to cause denial of service by triggering an interrupt handling errata.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80699?
CVE-2026-80699 is a denial of service vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context
In the nested state, the physical interrupt has already been deactivated through the HW bit in the LR. The extra deactivation would be harmless but can hit an errata case on AmpereOne, so avoid it here.
On AmpereOne, deactivating a physical interrupt through ICC_DIR_EL1 or ICC_EOIR1_EL1 (depending on EOImode) which is not active, but is the highest priority pending interrupt causes the cpu to lose the interrupt pending state and also prevents the delivery of future interrupts.
Which versions are affected by CVE-2026-80699?
How do I fix CVE-2026-80699?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-80699 being exploited?
There is no known exploitation of CVE-2026-80699 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-80699, GHSA-4f2r-mgjf-292r, UBUNTU-CVE-2026-80699.