CVE-2026-98712: Linux kernel · KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in 19bc5d79ece613f242b5ec03921a3b465321bfed : update Linux kernel when convenient.
Data as of 26 Oct 2026, 16:00 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 19bc5d79ece613f242b5ec03921a3b465321bfed, 8b25393d16a5ca8df907bd7ee1ff2e9d85678b3c, 6.20
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux to 19bc5d79ece613f242b5ec03921a3b465321bfed, 8b25393d16a5ca8df907bd7ee1ff2e9d85678b3c or 6.20; the Debian debian/linux package to 6.20.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
Debiandebian/linuxpkg:deb/debian/linuxOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
This vulnerability has been fixed in Linux kernel version 6.20 and in the commits identified by hashes 19bc5d79ece613f242b5ec03921a3b465321bfed and 8b25393d16a5ca8df907bd7ee1ff2e9d85678b3c. Users should upgrade to Linux kernel 6.20 or later to remediate this issue.
Description
A vulnerability in the Linux kernel's KVM arm64 virtual generic interrupt controller (vgic) was addressed by ensuring a reference count is taken on interrupts referenced by last_lr_irq. This fixes a fragile condition where the last interrupt inserted in a list register (LR) could disappear if a concurrently unmapped local peripheral interrupt (LPI) occurred.