Not yet scoredPublished Oct 23, 2026

CVE-2026-98877irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed

Updated under an hour ago (Oct 27, 2026, 8:10 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting “kvm-arm.vgic_v4_enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gic_domain” is NULL and the kernel attempts to access it. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 Mem abort info: ESR = 0x0000000096000006 CPU: 1 UID: 0 PID: 295 Comm: lkvm-static Not tainted 7.1.0-rc4-ge3f15ad3970e #5 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 81402005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : __irq_domain_instantiate+0x1d4/0x578 lr : __irq_domain_instantiate+0x1cc/0x578 Set vLPI support to false at init time if the host has no ITS, so it propagates properly to kvm_vgic_global_state.has_gicv4.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 23, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a75460547e13c99762c2f9dbfcdd13ad416f91c5 before 3e4cae9f1472ba3c9fe87edee24074618b51f537; from a75460547e13c99762c2f9dbfcdd13ad416f91c5 before a2508b8855acc96abe69be73b41b672f1ef12516; from a75460547e13c99762c2f9dbfcdd13ad416f91c5 before e79934064be85fc9a3a6434da857307d8b78e33d; from a75460547e13c99762c2f9dbfcdd13ad416f91c5 before 4761493dd663443f7353c184e6fa16e1cb3ac5a1; from a75460547e13c99762c2f9dbfcdd13ad416f91c5 before ab233119a19716b8f33e73ea7e092e0eb353cfbf; from a75460547e13c99762c2f9dbfcdd13ad416f91c5 before c8a911b3b07baa0aeb3dbc4e16a4670bd21bed40; from a75460547e13c99762c2f9dbfcdd13ad416f91c5 before e61654fbc3bc5d07ec9fafe29f33e19b2b5d0fd5	CNA record

References

References

https://git.kernel.org/stable/c/3e4cae9f1472ba3c9fe87edee24074618b51f537
https://git.kernel.org/stable/c/a2508b8855acc96abe69be73b41b672f1ef12516
https://git.kernel.org/stable/c/e79934064be85fc9a3a6434da857307d8b78e33d
https://git.kernel.org/stable/c/4761493dd663443f7353c184e6fa16e1cb3ac5a1
https://git.kernel.org/stable/c/ab233119a19716b8f33e73ea7e092e0eb353cfbf
https://git.kernel.org/stable/c/c8a911b3b07baa0aeb3dbc4e16a4670bd21bed40
https://git.kernel.org/stable/c/e61654fbc3bc5d07ec9fafe29f33e19b2b5d0fd5

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.