Race Condition in ARM64 KVM within Linux Kernel

CVE-2026-74568

What is CVE-2026-74568?

A race condition in the Linux kernel's ARM64 KVM can lead to improper management of LPI (Logical Peripheral Interrupt) structures during concurrent operations. Specifically, the vulnerability arises between two paths: direct and deferred release of an LPI. When the reference count of an LPI drops to zero, it may be incorrectly removed from the xarray while concurrently a new LPI is registered. This can result in unintended overwrites or leaks of IRQ structures, leading to potential system instability. The issue demonstrates that the reference count decrement and structure eviction must occur atomically, necessitating adjustments to ensure safe handling of LPI references under concurrent conditions.

References