Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-46316

KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry

Critical9.3EPSS 0.34%
Published
Updated
Reserved
Assigned by
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's reference on each entry with vgic_put_irq(). It puts the iterated pointer, though, rather than the value returned by xa_erase(). The function is called from contexts that do not exclude one another: the ITS command handlers hold its_lock, the GITS_CTLR write path holds cmd_lock, and the path that clears EnableLPIs in a redistributor's GICR_CTLR holds neither. Two or more of them can drain the same cache concurrently, and if each one observes the same entry, erases it and then puts it, the single reference the cache holds on that entry is dropped more than once. The entry can then be freed while an ITE still maps it. xa_erase() is atomic and returns the previous entry, so put only the entry that this context actually removed. The cache reference is then dropped exactly once per entry even when the invalidations run concurrently, and the behavior is unchanged when only one context runs.

Scores

CVSS scores of CVE-2026-46316, by who scored it
Scored byCVSSScoreVector
LinuxCNA (assigner)3.1Critical9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
redhat-SADPADP (enrichment)3.1High7.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified3.1Critical9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.34% · top 73% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

Affected products

  • Linux · Linux

    • affected 8201d1028caa4fae88e222c4e8cf541fdf45b821 – < b7b72e88046328c9fdc638fe887d4240257dd5dc
    • affected 8201d1028caa4fae88e222c4e8cf541fdf45b821 – < 2bbc395e81bd29c543a0529a678327e932a7ec69
    • affected 8201d1028caa4fae88e222c4e8cf541fdf45b821 – < 9121f4605ab94969f62d1b5714ca3c6c69bd202f
    • affected 8201d1028caa4fae88e222c4e8cf541fdf45b821 – < 13031fb6b8357fbbcded2a7f4cba73e4781ee594

  • Linux · Linux

    • affected 6.10
    • unaffected < 6.10
    • unaffected 6.12.93 – ≤ 6.12.*
    • unaffected 6.18.35 – ≤ 6.18.*
    • unaffected 7.0.12 – ≤ 7.0.*
    • unaffected 7.1 – ≤ *

References (15)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-46316 badge
[![CVE-2026-46316](https://trackcve.app/badge/CVE-2026-46316.svg)](https://trackcve.app/cve/CVE-2026-46316)

Record last updated .