CVE-2026-98877 - Vulnerability Details

- irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed

Description

In the Linux kernel, the following vulnerability has been resolved:

irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed

When accidentally setting “kvm-arm.vgic_v4_enable=1” on a system that has
no MSI controller device tree node and GICv4, it results a panic as
“gic_domain” is NULL and the kernel attempts to access it.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028
Mem abort info:
ESR = 0x0000000096000006

CPU: 1 UID: 0 PID: 295 Comm: lkvm-static Not tainted 7.1.0-rc4-ge3f15ad3970e #5 PREEMPT
Hardware name: linux,dummy-virt (DT)
pstate: 81402005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : __irq_domain_instantiate+0x1d4/0x578
lr : __irq_domain_instantiate+0x1cc/0x578

Set vLPI support to false at init time if the host has no ITS, so it
propagates properly to kvm_vgic_global_state.has_gicv4.

Published: 2026-10-23

Score: 4.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a75460547e13c99762c2f9dbfcdd13ad416f91c5`	affected	< 3e4cae9f1472ba3c9fe87edee24074618b51f537
`a75460547e13c99762c2f9dbfcdd13ad416f91c5`	affected	< a2508b8855acc96abe69be73b41b672f1ef12516
`a75460547e13c99762c2f9dbfcdd13ad416f91c5`	affected	< e79934064be85fc9a3a6434da857307d8b78e33d
`a75460547e13c99762c2f9dbfcdd13ad416f91c5`	affected	< 4761493dd663443f7353c184e6fa16e1cb3ac5a1
`a75460547e13c99762c2f9dbfcdd13ad416f91c5`	affected	< ab233119a19716b8f33e73ea7e092e0eb353cfbf
`a75460547e13c99762c2f9dbfcdd13ad416f91c5`	affected	< c8a911b3b07baa0aeb3dbc4e16a4670bd21bed40
`a75460547e13c99762c2f9dbfcdd13ad416f91c5`	affected	< e61654fbc3bc5d07ec9fafe29f33e19b2b5d0fd5

Linux

affected

Version	Status	Constraints
`4.15`	affected	—
`0`	unaffected	< 4.15
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3e4cae9f1472ba3c9fe87edee24074618b51f537)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a2508b8855acc96abe69be73b41b672f1ef12516)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e79934064be85fc9a3a6434da857307d8b78e33d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4761493dd663443f7353c184e6fa16e1cb3ac5a1)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ab233119a19716b8f33e73ea7e092e0eb353cfbf)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c8a911b3b07baa0aeb3dbc4e16a4670bd21bed40)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e61654fbc3bc5d07ec9fafe29f33e19b2b5d0fd5)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3e4cae9f1472ba3c9fe87edee24074618b51f537)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a2508b8855acc96abe69be73b41b672f1ef12516)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e79934064be85fc9a3a6434da857307d8b78e33d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4761493dd663443f7353c184e6fa16e1cb3ac5a1)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ab233119a19716b8f33e73ea7e092e0eb353cfbf)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c8a911b3b07baa0aeb3dbc4e16a4670bd21bed40)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e61654fbc3bc5d07ec9fafe29f33e19b2b5d0fd5)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00179.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98877.mbox
https://git.kernel.org/stable/c/3e4cae9f1472ba3c9fe87edee24074618b51f537
https://git.kernel.org/stable/c/4761493dd663443f7353c184e6fa16e1cb3ac5a1
https://git.kernel.org/stable/c/a2508b8855acc96abe69be73b41b672f1ef12516
https://git.kernel.org/stable/c/ab233119a19716b8f33e73ea7e092e0eb353cfbf
https://git.kernel.org/stable/c/c8a911b3b07baa0aeb3dbc4e16a4670bd21bed40
https://git.kernel.org/stable/c/e61654fbc3bc5d07ec9fafe29f33e19b2b5d0fd5
https://git.kernel.org/stable/c/e79934064be85fc9a3a6434da857307d8b78e33d
https://nvd.nist.gov/vuln/detail/CVE-2026-98877
https://www.cve.org/CVERecord?id=CVE-2026-98877

History

Tue, 27 Oct 2026 04:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98877.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98877 https://www.cve.org/CVERecord?id=CVE-2026-98877
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Weaknesses		CWE-476
Vendors & Products		Linux linux

Fri, 23 Oct 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting “kvm-arm.vgic_v4_enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gic_domain” is NULL and the kernel attempts to access it. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 Mem abort info: ESR = 0x0000000096000006 CPU: 1 UID: 0 PID: 295 Comm: lkvm-static Not tainted 7.1.0-rc4-ge3f15ad3970e #5 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 81402005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : __irq_domain_instantiate+0x1d4/0x578 lr : __irq_domain_instantiate+0x1cc/0x578 Set vLPI support to false at init time if the host has no ITS, so it propagates properly to kvm_vgic_global_state.has_gicv4.
Title		irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3e4cae9f1472ba3c9fe87edee24074618b51f537 https://git.kernel.org/stable/c/4761493dd663443f7353c184e6fa16e1cb3ac5a1 https://git.kernel.org/stable/c/a2508b8855acc96abe69be73b41b672f1ef12516 https://git.kernel.org/stable/c/ab233119a19716b8f33e73ea7e092e0eb353cfbf https://git.kernel.org/stable/c/c8a911b3b07baa0aeb3dbc4e16a4670bd21bed40 https://git.kernel.org/stable/c/e61654fbc3bc5d07ec9fafe29f33e19b2b5d0fd5 https://git.kernel.org/stable/c/e79934064be85fc9a3a6434da857307d8b78e33d

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T11:37:23.678Z

Updated: 2026-10-26T06:55:59.697Z

Reserved: 2026-09-25T10:25:14.377Z

Link: CVE-2026-98877

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T12:18:21.203

Modified: 2026-10-26T07:17:12.160

Link: CVE-2026-98877

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-98877 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-27T09:15:18Z

Weaknesses

CWE-476

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object