CVE-2026-72289

The CVSS 9.3 assigned to CVE-2026-72289 warrants scrutiny. The vulnerability involves a race condition in KVM arm64's virtual interrupt controller where vgic_prune_ap_list() drops a lock during interrupt migration while vgic_flush_pending_lpis() can remove the same interrupt during that window, resulting in a double-list_del() that causes list corruption. The patch addresses this with a single ownership check — `irq->vcpu == vcpu` — before the move operation. A 9.3 score conflates a narrow synchronization bug with catastrophic impact. The fix is telling: a one-line ownership check suggests this was a logical consistency gap between two code paths that were assumed never to race, not a missing security boundary. If this were a genuine hypervisor escape vector, you'd expect the remediation to involve locking schema changes or defensive structures, not a single condition. The real question is whether a malicious VM can reliably trigger this interleaving. The window requires a specific ordering of two distinct code paths — one that prunes stale affinities, another that flushes pending LPIs. Neither path is directly guest-controlled. Historical evidence matters here: double-list_del() bugs in kernel interrupt controller paths have consistently manifested as host denial-of-service under specific interrupt loads rather than as information disclosure or privilege escalation. The list poisoning and debugging mechanisms built into the kernel make exploitation for anything beyond crash extremely difficult. The severity calculus changes significantly in multi-tenant cloud environments. A guest-triggerable host panic on a node running 40 tenant workloads creates catastrophic blast radius regardless of whether the attacker gains additional privilege — the collateral damage is measured in disrupted unrelated VMs, not the attacker's own instance. However, this still points to an availability impact with high attack complexity rather than a reliable privilege escalation path. This bug fits a pattern. Similar race conditions in KVM interrupt handling have surfaced across architectures — CVE-2017-12154, CVE-2019-7221, CVE-2021-26931 all involved synchronization failures in interrupt controller state transitions. The repetition suggests the root cause isn't a missing security boundary but rather undocumented invariants in the vgic interrupt state machine that accumulate as independently-evolved code paths from different eras gradually develop unexpected interactions. The CVSS should reflect that this is an availability-focused bug with high trigger complexity rather than a hypervisor escape vector requiring emergency patch deployment.

Reviewed through automated stages and approved by a human before publication.