Answer in brief
CVE-2026-98877 records a Unknown severity vulnerability in irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <3e4cae9f1472ba3c9fe87edee24074618b51f537 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <a2508b8855acc96abe69be73b41b672f1ef12516 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <e79934064be85fc9a3a6434da857307d8b78e33d || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4761493dd663443f7353c184e6fa16e1cb3ac5a1 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <ab233119a19716b8f33e73ea7e092e0eb353cfbf || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <c8a911b3b07baa0aeb3dbc4e16a4670bd21bed40 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <e61654fbc3bc5d07ec9fafe29f33e19b2b5d0fd5 || >=0 <5.10.271 || >=0 <5.15.222 || >=0 <6.1.189 || >=0 <6.6.158 || >=0 <6.12.111 || >=0 <6.18.53 | 3e4cae9f1472ba3c9fe87edee24074618b51f537, a2508b8855acc96abe69be73b41b672f1ef12516, e79934064be85fc9a3a6434da857307d8b78e33d, 4761493dd663443f7353c184e6fa16e1cb3ac5a1, ab233119a19716b8f33e73ea7e092e0eb353cfbf, c8a911b3b07baa0aeb3dbc4e16a4670bd21bed40, e61654fbc3bc5d07ec9fafe29f33e19b2b5d0fd5, 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53 |
Published upstream
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 23, 2026
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting “kvm-arm.vgic_v4_enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gic_domain” is NULL and the kernel attempts to access it. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 Mem abort info: ESR = 0x0000000096000006 CPU: 1 UID: 0 PID: 295 Comm: lkvm-static Not tainted 7.1.0-rc4-ge3f15ad3970e #5 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 81402005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : __irq_domain_instantiate+0x1d4/0x578 lr : __irq_domain_instantiate+0x1cc/0x578 Set vLPI support to false at init time if the host has no ITS, so it propagates properly to kvm_vgic_global_state.has_gicv4.
Quoted source text, attributed separately from HOL analysis.