CVE-2026-98877 irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-98877?
CVE-2026-98877 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed
When accidentally setting “kvm-arm.vgic_v4_enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gic_domain” is NULL and the kernel attempts to access it.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 Mem abort info: ESR = 0x0000000096000006
CPU: 1 UID: 0 PID: 295 Comm: lkvm-static Not tainted 7.1.0-rc4-ge3f15ad3970e #5 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 81402005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : __irq_domain_instantiate+0x1d4/0x578 lr : __irq_domain_instantiate+0x1cc/0x578
Set vLPI support to false at init time if the host has no ITS, so it propagates properly to kvm_vgic_global_state.has_gicv4.
Which versions are affected by CVE-2026-98877?
How do I fix CVE-2026-98877?
Upgrade to a fixed version.
Is CVE-2026-98877 being exploited?
There is no known exploitation of CVE-2026-98877 in the wild and no public exploit code.
Sources
Also known as AZL-110605, BELL-CVE-2026-98877, DEBIAN-CVE-2026-98877, GHSA-32qr-g6m6-8v7x, UBUNTU-CVE-2026-98877.