CVE-2026-98878 (GCVE-0-2026-98878)

Vulnerability from cvelistv5 – Published: 2026-10-23 11:37 – Updated: 2026-10-23 11:37
VLAI
Title
irqchip/gic-v5: Immediately exec priority drop following activate
Summary
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Immediately exec priority drop following activate With GICv5 an interrupt of equal or lower priority cannot be signalled until there has been a priority drop. This is done via the GIC CDEOI system instruction. Once this has been executed, the hardware is able to signal the next interrupt if there is one. As all interrupts are programmed to have the same priority, no new interrupts can be signalled until the priority drop has happened. This can cause issues when, for example, an interrupt remains active while a long running process takes place, such as when injecting a physical interrupt into a guest VM in software. The GICv5 driver has so far done the priority drop as part of irq_eoi(), i.e., at the same time as deactivating the interrupt. This means that any long running process (or VM) could block incoming interrupts, effectively causing a denial of service for all other interrupts. Rather than doing the EOI as part of irq_eoi() (which the name would suggest would be a good place for it), move it to happen immediately after acknowledging an interrupt in the main GICv5 interrupt handler. The deactivation of interrupts (GIC CDDI) remains implemented as part of irq_eoi(), which means that the same interrupt cannot be signalled a second time until deactivated by software.
Severity
No CVSS data available.
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7061 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c29bb5acd0cad0b49399d1399dd1bacb39e41438 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < abf60331ebe9a9a7937a72aac7699c2907ab9307 (git)
Affected: 0 , < 6.18.53 (semver)
guessed Create a notification for this product.
Linux Linux Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/irqchip/irq-gic-v5.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c29bb5acd0cad0b49399d1399dd1bacb39e41438",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "abf60331ebe9a9a7937a72aac7699c2907ab9307",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.18.53",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/irqchip/irq-gic-v5.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v5: Immediately exec priority drop following activate\n\nWith GICv5 an interrupt of equal or lower priority cannot be signalled\nuntil there has been a priority drop. This is done via the GIC CDEOI\nsystem instruction. Once this has been executed, the hardware is able\nto signal the next interrupt if there is one.\n\nAs all interrupts are programmed to have the same priority, no new\ninterrupts can be signalled until the priority drop has happened. This\ncan cause issues when, for example, an interrupt remains active while\na long running process takes place, such as when injecting a physical\ninterrupt into a guest VM in software.\n\nThe GICv5 driver has so far done the priority drop as part of\nirq_eoi(), i.e., at the same time as deactivating the interrupt. This\nmeans that any long running process (or VM) could block incoming\ninterrupts, effectively causing a denial of service for all other\ninterrupts.\n\nRather than doing the EOI as part of irq_eoi() (which the name would\nsuggest would be a good place for it), move it to happen immediately\nafter acknowledging an interrupt in the main GICv5 interrupt\nhandler. The deactivation of interrupts (GIC CDDI) remains implemented\nas part of irq_eoi(), which means that the same interrupt cannot be\nsignalled a second time until deactivated by software."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T11:37:25.121Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c29bb5acd0cad0b49399d1399dd1bacb39e41438"
        },
        {
          "url": "https://git.kernel.org/stable/c/abf60331ebe9a9a7937a72aac7699c2907ab9307"
        }
      ],
      "title": "irqchip/gic-v5: Immediately exec priority drop following activate",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98878",
    "datePublished": "2026-10-23T11:37:25.121Z",
    "dateReserved": "2026-09-25T10:25:14.377Z",
    "dateUpdated": "2026-10-23T11:37:25.121Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "microsoft_vex": {
      "current_release_date": "2026-10-24T01:04:56.000Z",
      "cve": "CVE-2026-98878",
      "id": "msrc_CVE-2026-98878",
      "initial_release_date": "2026-10-24T01:01:47.000Z",
      "product_status:known_affected": "1",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "irqchip/gic-v5: Immediately exec priority drop following activate",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-98878.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/irqchip/irq-gic-v5.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c29bb5acd0cad0b49399d1399dd1bacb39e41438",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "abf60331ebe9a9a7937a72aac7699c2907ab9307",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.18.53",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/irqchip/irq-gic-v5.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v5: Immediately exec priority drop following activate\n\nWith GICv5 an interrupt of equal or lower priority cannot be signalled\nuntil there has been a priority drop. This is done via the GIC CDEOI\nsystem instruction. Once this has been executed, the hardware is able\nto signal the next interrupt if there is one.\n\nAs all interrupts are programmed to have the same priority, no new\ninterrupts can be signalled until the priority drop has happened. This\ncan cause issues when, for example, an interrupt remains active while\na long running process takes place, such as when injecting a physical\ninterrupt into a guest VM in software.\n\nThe GICv5 driver has so far done the priority drop as part of\nirq_eoi(), i.e., at the same time as deactivating the interrupt. This\nmeans that any long running process (or VM) could block incoming\ninterrupts, effectively causing a denial of service for all other\ninterrupts.\n\nRather than doing the EOI as part of irq_eoi() (which the name would\nsuggest would be a good place for it), move it to happen immediately\nafter acknowledging an interrupt in the main GICv5 interrupt\nhandler. The deactivation of interrupts (GIC CDDI) remains implemented\nas part of irq_eoi(), which means that the same interrupt cannot be\nsignalled a second time until deactivated by software."
          }
        ],
        "id": "CVE-2026-98878",
        "lastModified": "2026-10-23T12:18:21.330",
        "metrics": {},
        "published": "2026-10-23T12:18:21.330",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/abf60331ebe9a9a7937a72aac7699c2907ab9307"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c29bb5acd0cad0b49399d1399dd1bacb39e41438"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.