CVE-2026-89912: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-89912 is a NULL pointer dereference vulnerability in the Linux kernel's KVM subsystem, specifically in the vgic_its_save_ite() function of the ARM64 virtual GIC ITS (Interrupt Translation Service) implementation. The flaw allows a guest virtual machine to trigger a host kernel oops (crash) during VM migration when the VMM issues KVM_DEV_ARM_ITS_SAVE_TABLES. It affects Linux kernel versions from 4.12 up to (but not including) the fixed commits, with patched versions available at 6.18.51, 7.2.5, and 7.3-rc1. It carries a CVSS v3.1 base score of 7.1 (High) (Feedly).

The root cause is a NULL pointer dereference (CWE-476) in vgic_its_save_ite() within the Linux kernel's vgic-its driver for ARM64 KVM. When a guest issues a MAPC command with V=0, the ITE's (Interrupt Translation Entry) collection pointer is set to NULL, but the ITE remains on the device's ITT (Interrupt Translation Table) list. Subsequently, when the VMM calls KVM_DEV_ARM_ITS_SAVE_TABLES to migrate the VM, vgic_its_save_ite() unconditionally dereferences ite->collection, causing a kernel oops on the host. The fix saves a zeroed entry instead, which vgic_its_restore_ite() correctly reads back as invalid, preventing the NULL dereference (Feedly, Kernel Patch 1).

Successful exploitation causes a host kernel oops (denial of service), crashing or destabilizing the hypervisor host during a VM migration operation. The availability impact is high and crosses the VM boundary (scope changed), meaning a guest VM can affect the stability of the host system. There is no confidentiality or integrity impact identified; the primary risk is disruption of the host and all co-located virtual machines (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-89912. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a guest VM to issue a specific sequence of ITS commands (MAPD, MAPTI, then MAPC with V=0) followed by the VMM triggering a live migration, which is an architecturally UNPREDICTABLE sequence but achievable by a malicious or compromised guest (Feedly).

1. Precondition: Attacker controls a guest VM running on an ARM64 KVM host with a virtual GIC ITS device exposed.
2. Issue MAPD command: The guest issues a MAPD (Map Device) command to register a device in the ITS.
3. Issue MAPTI command: The guest issues a MAPTI (Map Interrupt Translation) command to create an ITE (Interrupt Translation Entry) associated with a collection.
4. Issue MAPC(V=0) command: The guest issues a MAPC (Map Collection) command with the Valid bit (V) set to 0, which drops ite->collection to NULL while leaving the ITE on the device's ITT list.
5. Trigger VM migration: Wait for or induce the VMM (Virtual Machine Monitor) to issue KVM_DEV_ARM_ITS_SAVE_TABLES as part of a live migration operation.
6. Host kernel oops: vgic_its_save_ite() unconditionally dereferences the NULL ite->collection pointer, causing a kernel oops on the host and crashing or destabilizing the hypervisor (Feedly).

• Logs: Host kernel logs (dmesg, /var/log/kern.log) showing a kernel oops or NULL pointer dereference in vgic_its_save_ite() or related KVM/vgic-its stack frames during a VM migration event.
• Process: Unexpected termination or crash of the VMM process (e.g., QEMU) coinciding with a KVM_DEV_ARM_ITS_SAVE_TABLES ioctl call on an ARM64 host.
• System: Unexpected host reboots or kernel panics on ARM64 KVM hypervisors during live migration of guest VMs with virtual GIC ITS devices (Feedly).

Apply the upstream kernel patches that fix the NULL dereference by saving a zeroed ITE entry instead of dereferencing the NULL collection pointer. Fixed versions include Linux kernel 6.18.51, 7.2.5, and 7.3-rc1. The relevant upstream commits are 3d4c26b16a04, 36df368861d2, and c6c156d931c3. As a workaround where patching is not immediately possible, restricting guest VM live migration on ARM64 KVM hosts or disabling virtual GIC ITS exposure to untrusted guests can reduce exposure (Feedly, Kernel Patch 1).