HIGH Introduced in 4.12
kvm ITT Save Deref
CVE-2026-89912
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
KernelScan AI7.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite->collection but leaves the ITE on the device's ITT list, and vgic_its_save_ite() dereferences it unconditionally. A guest that issues MAPD, MAPTI and then MAPC(V=0) therefore oopses the host when the VMM issues KVM_DEV_ARM_ITS_SAVE_TABLES to migrate it. That sequence is UNPREDICTABLE per the architecture, but KVM already handles the resulting state in the translate, MOVI and DISCARD paths. Save a zeroed entry, which vgic_its_restore_ite() reads back as invalid. Skipping the ITE instead would leave the ITT slot holding whatever is in guest memory, and restore rejects an entry naming a collection the restored collection table does not have.
02KernelScan AI Analysis
Risk summary
A malicious ARM64 guest VM can crash the host kernel by issuing a specific sequence of GIC ITS commands that leave an interrupt translation entry with a NULL collection pointer. When the VMM later performs a save-tables operation for migration, the host kernel dereferences the NULL pointer and oopses. This affects any KVM arm64 host running guests with vgic-its enabled, with impact limited to denial of service of the host and all co-located VMs.
Vulnerability analysis
When a guest VM issues a MAPC command with the valid bit clear, the collection pointer on an interrupt translation entry is dropped but the entry itself remains on the device's list. Later, when the host-side VMM triggers a save-tables operation for migration, the save routine dereferences that collection pointer unconditionally, hitting a NULL pointer and crashing the host kernel. The fix adds a NULL check before the dereference: if the collection is absent, a zeroed entry is written instead, which the restore path correctly interprets as invalid. A malicious guest can trigger this by issuing the command sequence and waiting for the host to initiate migration; no special privileges are needed beyond being a running guest on an ARM64 KVM host with vgic-its enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 4.12 | 7.2.5 | 36df368861d2 |
| mainline | 4.12 | 7.3-rc1 | c6c156d931c3 |
| 6.18 | 4.12 | 6.18.51 | 3d4c26b16a04 |