CVE-2026-98877irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed
- —Not scoredno CVSS score yet
- 0.18%Exploitation in 30 daysEPSS · top 92% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting “kvm-arm.vgic_v4_enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gic_domain” is NULL and the kernel attempts to access it. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 Mem abort info: ESR = 0x0000000096000006 CPU: 1 UID: 0 PID: 295 Comm: lkvm-static Not tainted 7.1.0-rc4-ge3f15ad3970e #5 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 81402005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : __irq_domain_instantiate+0x1d4/0x578 lr : __irq_domain_instantiate+0x1cc/0x578 Set vLPI support to false at init time if the host has no ITS, so it propagates properly to kvm_vgic_global_state.has_gicv4.
Timeline
ID reserved
By Linux
- 28 days later
· 28 days later
Published
- 3 days later
· 3 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.18% · top 92% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected a75460547e13c99762c2f9dbfcdd13ad416f91c5 – < 3e4cae9f1472ba3c9fe87edee24074618b51f537
- affected a75460547e13c99762c2f9dbfcdd13ad416f91c5 – < a2508b8855acc96abe69be73b41b672f1ef12516
- affected a75460547e13c99762c2f9dbfcdd13ad416f91c5 – < e79934064be85fc9a3a6434da857307d8b78e33d
- affected a75460547e13c99762c2f9dbfcdd13ad416f91c5 – < 4761493dd663443f7353c184e6fa16e1cb3ac5a1
- affected a75460547e13c99762c2f9dbfcdd13ad416f91c5 – < ab233119a19716b8f33e73ea7e092e0eb353cfbf
- affected a75460547e13c99762c2f9dbfcdd13ad416f91c5 – < c8a911b3b07baa0aeb3dbc4e16a4670bd21bed40
- affected a75460547e13c99762c2f9dbfcdd13ad416f91c5 – < e61654fbc3bc5d07ec9fafe29f33e19b2b5d0fd5
- affected 4.15
- unaffected < 4.15
- unaffected 5.10.271 – ≤ 5.10.*
- unaffected 5.15.222 – ≤ 5.15.*
- unaffected 6.1.189 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.111 – ≤ 6.12.*
- unaffected 6.18.53 – ≤ 6.18.*
- unaffected 7.2 – ≤ *
References
References7
- https://git.kernel.org/stable/c/3e4cae9f1472ba3c9fe87edee24074618b51f537 (opens in a new tab)
- https://git.kernel.org/stable/c/a2508b8855acc96abe69be73b41b672f1ef12516 (opens in a new tab)
- https://git.kernel.org/stable/c/e79934064be85fc9a3a6434da857307d8b78e33d (opens in a new tab)
- https://git.kernel.org/stable/c/4761493dd663443f7353c184e6fa16e1cb3ac5a1 (opens in a new tab)
- https://git.kernel.org/stable/c/ab233119a19716b8f33e73ea7e092e0eb353cfbf (opens in a new tab)
- https://git.kernel.org/stable/c/c8a911b3b07baa0aeb3dbc4e16a4670bd21bed40 (opens in a new tab)
- https://git.kernel.org/stable/c/e61654fbc3bc5d07ec9fafe29f33e19b2b5d0fd5 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-108723 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98877)Record last updated .