CVE-2026-46316KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry
- 9.3CriticalCVSS base score
- 0.34%Exploitation in 30 daysEPSS · top 72% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's reference on each entry with vgic_put_irq(). It puts the iterated pointer, though, rather than the value returned by xa_erase(). The function is called from contexts that do not exclude one another: the ITS command handlers hold its_lock, the GITS_CTLR write path holds cmd_lock, and the path that clears EnableLPIs in a redistributor's GICR_CTLR holds neither. Two or more of them can drain the same cache concurrently, and if each one observes the same entry, erases it and then puts it, the single reference the cache holds on that entry is dropped more than once. The entry can then be freed while an ITE still maps it. xa_erase() is atomic and returns the previous entry, so put only the entry that this context actually removed. The cache reference is then dropped exactly once per entry even when the invalidations run concurrently, and the behavior is unchanged when only one context runs.
Timeline
ID reserved
By Linux
- 27 days later
· 27 days later
Published
- 4 months later
· 4 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| redhat-SADPADP (enrichment) | 3.1 | High7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.34% · top 72% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.
Affected products
- affected 8201d1028caa4fae88e222c4e8cf541fdf45b821 – < b7b72e88046328c9fdc638fe887d4240257dd5dc
- affected 8201d1028caa4fae88e222c4e8cf541fdf45b821 – < 2bbc395e81bd29c543a0529a678327e932a7ec69
- affected 8201d1028caa4fae88e222c4e8cf541fdf45b821 – < 9121f4605ab94969f62d1b5714ca3c6c69bd202f
- affected 8201d1028caa4fae88e222c4e8cf541fdf45b821 – < 13031fb6b8357fbbcded2a7f4cba73e4781ee594
- affected 6.10
- unaffected < 6.10
- unaffected 6.12.93 – ≤ 6.12.*
- unaffected 6.18.35 – ≤ 6.18.*
- unaffected 7.0.12 – ≤ 7.0.*
- unaffected 7.1 – ≤ *
References
References15
- https://git.kernel.org/stable/c/b7b72e88046328c9fdc638fe887d4240257dd5dc (opens in a new tab)
- https://git.kernel.org/stable/c/2bbc395e81bd29c543a0529a678327e932a7ec69 (opens in a new tab)
- https://git.kernel.org/stable/c/9121f4605ab94969f62d1b5714ca3c6c69bd202f (opens in a new tab)
- https://git.kernel.org/stable/c/13031fb6b8357fbbcded2a7f4cba73e4781ee594 (opens in a new tab)
- https://access.redhat.com/security/cve/CVE-2026-46316 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2486982 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46316.json (opens in a new tab)x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:44231 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40787 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40779 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40764 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:39371 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34911 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:38902 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36018 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-35405 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-46316)Record last updated .