CVE-2026-74568

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: arm64: vgic: Fix race between LPI release and re-registration<br /> <br /> Fix a potential race between decrementing an LPI&amp;#39;s reference count and<br /> evicting that structure from the LPI xarray.<br /> <br /> LPI structures are maintained in the VGIC LPI xarray (dist-&gt;lpi_xa).<br /> When the reference count of an LPI structure drops to zero,<br /> vgic_release_lpi_locked() removes the structure from the xarray and<br /> frees it under the xarray lock.<br /> <br /> However, the release of an LPI can race with a concurrent LPI<br /> re-registration with the same INTID via vgic_add_lpi() on another CPU,<br /> since the reference count drop and the xarray eviction are not performed<br /> in a single atomic step. This can happen e.g. if the guest issues a<br /> DISCARD while the LPI is still referenced from a vCPU&amp;#39;s active-pending<br /> list (ap_list), and the same INTID is re-mapped via MAPTI.<br /> <br /> Particularly, vgic_release_lpi_locked() is called from two distinct<br /> paths: direct release via vgic_put_irq(), and deferred release via<br /> vgic_release_deleted_lpis(). During direct release, the issue can result<br /> in deleting a newly registered LPI from the xarray:<br /> <br /> CPU0 (Releasing LPI) CPU1 (Adding new LPI)<br /> ==================== =====================<br /> vgic_put_irq()<br /> __vgic_put_irq()<br /> refcount_dec_and_test()<br /> vgic_add_lpi()<br /> xa_lock_irqsave()<br /> old_irq = xa_load(.., intid)<br /> vgic_try_get_irq_ref(old_irq) == false<br /> new IRQ inserted --&gt; __xa_store(.., intid, ..)<br /> xa_unlock_irqrestore()<br /> xa_lock_irqsave();<br /> vgic_release_lpi_locked()<br /> __xa_erase(.., irq-&gt;intid) pending_release = true<br /> vgic_add_lpi()<br /> xa_lock_irqsave()<br /> old_irq = xa_load(.., intid)<br /> vgic_try_get_irq_ref(oldirq) == false<br /> BUG: old IRQ overwritten --&gt; __xa_store(.., intid, ..)<br /> xa_unlock_irqrestore()<br /> <br /> vgic_release_deleted_lpis()<br /> xa_lock_irqsave()<br /> xa_for_each() { .. }