CVE-2026-46316

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry<br /> <br /> vgic_its_invalidate_cache() walks the per-ITS translation cache with<br /> xa_for_each() and drops the cache&amp;#39;s reference on each entry with<br /> vgic_put_irq(). It puts the iterated pointer, though, rather than the<br /> value returned by xa_erase().<br /> <br /> The function is called from contexts that do not exclude one another: the<br /> ITS command handlers hold its_lock, the GITS_CTLR write path holds<br /> cmd_lock, and the path that clears EnableLPIs in a redistributor&amp;#39;s<br /> GICR_CTLR holds neither. Two or more of them can drain the same cache<br /> concurrently, and if each one observes the same entry, erases it and then<br /> puts it, the single reference the cache holds on that entry is dropped<br /> more than once. The entry can then be freed while an ITE still maps it.<br /> <br /> xa_erase() is atomic and returns the previous entry, so put only the entry<br /> that this context actually removed. The cache reference is then dropped<br /> exactly once per entry even when the invalidations run concurrently, and<br /> the behavior is unchanged when only one context runs.