CVE-2026-72283
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In the Linux kernel, KVM x86 has a vulnerability where the irqfd->producer pointer is not nullified if updating the IRTE for bypass fails. Leaving a dangling pointer can lead to a use-after-free if the irqfd is reachable through KVM's routing, but the producer is freed separately.
Risk Assessment
This can lead to kernel memory corruption, potentially enabling privilege escalation or system crash.
Recommendation
Install the Linux kernel patch that nullifies the irqfd->producer pointer on IRTE update failure. Prioritize deployment in virtualized environments.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails Nullify irqfd->producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is reachable through KVM's routing, but the producer is freed separately. E.g. for VFIO PCI, the producer is embedded in struct "vfio_pci_irq_ctx" and freed when the vector is disabled, which can happen independent of routing updates. [sean: drop PPC change, massage changelog]