CVE-2026-89912 Linux CVE debrief

Who should care

Defenders managing Linux systems, especially those with untrusted local access or in cloud environments, should assess exposure and prioritize patching. This includes operators of Linux-based infrastructure, security teams responsible for vulnerability management, and administrators of cloud services that rely on Linux kernels.

Why it matters

CVE-2026-89912 is a Linux kernel vulnerability that can cause a host denial of service. Defenders should prioritize patching affected systems, especially those with untrusted local access or in cloud environments.

• Denial of service via system crash
• Potential disruption to critical infrastructure
• Need for version verification and patching

Technical summary

The Linux kernel vulnerability occurs in the KVM arm64 vgic-its emulation. When a specific sequence of device emulation commands is executed, it leads to a NULL pointer dereference during the save operation of ITT (Interrupt Translation Table). This results in a host denial of service. The vulnerability is particularly relevant for defenders managing Linux systems, especially those with untrusted local access or in cloud environments, as it could lead to system crashes and potential disruption to critical infrastructure.

Defensive priority

Defenders should prioritize patching affected Linux systems, especially those with untrusted local access.

Recommended defensive actions

• Patch affected Linux systems, especially those with untrusted local access
• Inventory Linux systems for version checks
• Monitor system logs for potential denial of service attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a NULL pointer dereference in the vgic-its save functionality. The sequence leading to the crash is MAPD, MAPTI, and then MAPC with V=0. This issue arises from the KVM arm64 vgic-its emulation, where a specific sequence of device emulation commands leads to a NULL pointer dereference during the save operation of ITT (Interrupt Translation Table).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.