In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally… (CVE-2026-98877)

The Linux kernel vulnerability (CVE-2026-98877) involves the irqchip/gic-v4 driver improperly advertising Virtual Locality-specific Peripheral Interrupts (VLPIs) when no Interrupt Translation Service (ITS) is present. If the kernel parameter kvm-arm.vgic_v4_enable=1 is set on a system without an MSI controller device tree node and GICv4, the kernel attempts to access a NULL gic_domain pointer, leading to a kernel panic due to a NULL pointer dereference. The issue is fixed by setting vLPI support to false at initialization if the host lacks ITS, ensuring the kernel does not propagate vLPI support incorrectly to kvm_vgic_global_state.has_gicv4.

This vulnerability can cause a kernel panic due to a NULL pointer dereference when the affected kernel configuration is used, potentially leading to denial of service on affected systems. There is no indication of code execution or privilege escalation from the provided data.

A fix is available that disables vLPI support at initialization if the host has no ITS, preventing the NULL pointer dereference. Users should update to a Linux kernel version that includes this fix. Since no specific patch links or versions are provided, check the vendor or Linux kernel advisories for the official patch and update guidance.