CVE-2026-72289

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic: Check the interrupt is still ours before migrating it

vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating

an interrupt to another vCPU. After reacquiring the locks it only checks

that the affinity is unchanged (target_vcpu == vgic_target_oracle(irq))

before moving the interrupt, which assumes that an interrupt whose affinity

is preserved is still queued on this vCPU's ap_list.

That assumption no longer holds if the interrupt is taken off the ap_list

while the locks are dropped. vgic_flush_pending_lpis() removes the

interrupt from the list and sets irq->vcpu to NULL, but leaves

enabled/pending/target_vcpu untouched. As the interrupt is still enabled

and pending, vgic_target_oracle() returns the same target_vcpu, so the

affinity check passes and list_del() is run a second time on an entry that

has already been removed.

Also check that the interrupt is still assigned to this vCPU

(irq->vcpu == vcpu) before moving it.