CVE-2026-46316

The `vgic_its_invalidate_cache()` function iterates over the ITS translation cache using `xa_for_each()` and releases cache references for each entry by calling `vgic_put_irq()`. The bug is that instead of the pointer returned by `xa_erase()` (the actually removed entry), the function releases the reference to the pointer from the iteration. Since this function can be called concurrently by multiple code paths (ITS command handlers, GITS_CTLR write path, EnableLPIs cleanup path in GICR_CTLR), which do not mutually exclude each other, each can observe the same entry, remove it, and release the reference — resulting in multiple releases of a single cache reference. The effect is a situation where an entry can be freed despite still being mapped by an ITE (ITS Table Entry).

An attacker or malicious code running locally can trigger a use-after-free error in the kernel, potentially enabling privilege escalation, data disclosure, or host system destabilization (denial of service) in a KVM virtualization environment on arm64 architecture.

Apply patches available in stable Linux kernel branches according to references: commits 13031fb6b835, 2bbc395e81bd, 9121f4605ab9, and b7b72e88046 available at git.kernel.org/stable addresses indicated in the vulnerability description.

Linux kernel with KVM arm64 subsystem (vgic-its); specific versions indicated in vendor references (patches available in stable kernel branches at addresses provided in references).