Linux Kernel Vulnerability in GICv4 Affecting System Stability

CVE-2026-98877

What is CVE-2026-98877?

This vulnerability in the Linux kernel relates to the configuration of the Generic Interrupt Controller version 4 (GICv4). When the parameter 'kvm-arm.vgic_v4_enable' is mistakenly set to '1' on a system that lacks a Message Signaled Interrupt (MSI) controller, it can lead to a critical failure. Specifically, the kernel encounters a NULL pointer dereference due to an uninitialized interrupt domain, causing a kernel panic. The system is unable to manage interrupts correctly, which severely impacts system stability. To mitigate this issue, it's essential to ensure that vLPI (virtual Low-priority interrupts) support is correctly disabled during initialization when no interrupt translation service (ITS) exists.

References