Search: CVE-2026-72288

CVE-2026-72288 is a critical vulnerability in the Linux kernel's KVM arm64 virtual generic interrupt controller (vgic) subsystem. It involves a race condition between interrupt affinity changes and disabling of Locality-specific Peripheral Interrupts (LPIs), which can lead to use-after-free (UAF) conditions. The flaw occurs when multiple virtual CPUs concurrently modify interrupt states, potentially causing the kernel to access freed memory. This vulnerability has been fixed in several Linux kernel commits.