PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-98877 Linux CVE debrief

A Linux kernel vulnerability allows a NULL pointer dereference when 'kvm-arm.vgic_v4_enable=1' is set on a system with no MSI controller device tree node and GICv4. This results in a kernel panic. The issue arises from the improper initialization of GICv4 and ITS, leading to a NULL pointer dereference and subsequent kernel panic when attempting to access the 'gic_domain'. To address this, it is crucial to verify kernel versions and configurations to ensure proper initialization of GICv4 and ITS.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-26
Advisory published
2026-10-23
Advisory updated
2026-10-26

Who should care

Linux system administrators and users who have GICv4 and ITS enabled in their kernel configurations should verify their kernel versions and configurations to ensure proper initialization of GICv4 and ITS. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and assess their systems for potential exposures. Operators of Linux-based systems should also be aware of this vulnerability and take necessary steps to

Why it matters

This vulnerability requires verification of Linux kernel versions and configurations to prevent NULL pointer dereferences and kernel panics.

  • Verify kernel versions to prevent NULL pointer dereferences
  • Review system configurations to ensure proper GICv4 and ITS initialization
  • Monitor system logs for potential errors

Technical summary

The Linux kernel vulnerability CVE-2026-98877 occurs when 'kvm-arm.vgic_v4_enable=1' is set on a system with no MSI controller device tree node and GICv4, resulting in a NULL pointer dereference and kernel panic. This is due to the improper initialization of GICv4 and ITS. The vulnerability requires verification of Linux kernel versions and configurations to prevent NULL pointer dereferences and kernel panics. Affected systems may experience operational impacts, including system crashes and potential security breaches.

Defensive priority

Verify Linux kernel versions and configurations to ensure proper initialization of GICv4 and ITS.

Recommended defensive actions

  • Verify Linux kernel versions to ensure they are up-to-date and patched
  • Review system configurations to ensure proper initialization of GICv4 and ITS
  • Monitor system logs for potential NULL pointer dereference errors
  • Perform vulnerability assessments to identify potential exposures
  • Implement compensating controls for exposed systems
  • Conduct regular security audits to detect and address vulnerabilities
  • Track and analyze system logs for anomalies

Evidence notes

The CVE record and source item provide details on the vulnerability, including a description of the issue and affected versions. The Linux kernel vulnerability CVE-2026-98877 occurs due to improper initialization of GICv4 and ITS, leading to a NULL pointer dereference and kernel panic. Evidence is limited to public sources and may not be comprehensive. Further verification is required to ensure accurate scope and impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-98877 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-98877

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-98877 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-98877

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98877.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3e4cae9f1472ba3c9fe87edee24074618b51f537

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a2508b8855acc96abe69be73b41b672f1ef12516

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e79934064be85fc9a3a6434da857307d8b78e33d

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4761493dd663443f7353c184e6fa16e1cb3ac5a1

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ab233119a19716b8f33e73ea7e092e0eb353cfbf

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c8a911b3b07baa0aeb3dbc4e16a4670bd21bed40

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e61654fbc3bc5d07ec9fafe29f33e19b2b5d0fd5

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.