CVE-2026-72294

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The flaw is reached only through local KVM ioctls on /dev/kvm (KVM_CREATE_VM, KVM_CREATE_VCPU, KVM_INTERRUPT on the vCPU fd); kvm_arch_vcpu_unlocked_ioctl() passes attacker-controlled irq values into kvm_vcpu_ioctl_interrupt() with no network, adjacent, or physical entry path.

AC:LAttack complexity, low

One KVM_INTERRUPT ioctl with irq >= 15 or irq=0x80000000 deterministically calls kvm_queue_irq()/kvm_dequeue_irq(), which invoke set_bit()/clear_bit() far past the 15-bit irq_pending/irq_clear fields; no race, timing window, or attacker-uncontrollable memory layout is required.

PR:LPrivileges required, low

Exploitation needs only permission to open /dev/kvm and manage a VM/vCPU (commonly kvm group membership or CAP_SYS_ADMIN obtainable inside a user namespace); it does not require init-namespace root or capabilities unavailable to an unprivileged local tenant.

UI:NUser interaction, none

No victim or operator interaction beyond the attacker's own KVM setup is required; once /dev/kvm access exists, a single malicious KVM_INTERRUPT ioctl on a controlled vCPU fd triggers the out-of-bounds bit manipulation.

S:CScope, changed

A KVM VM operator can corrupt host kernel memory in kvm_vcpu_arch from the KVM userspace interface, crossing the guest/VM-to-host virtualization boundary rather than confining impact to the attacker's own VM security scope.

C:HConfidentiality impact, high

Unvalidated irq indices make set_bit()/clear_bit() operate many words beyond irq_pending/irq_clear, corrupting adjacent host vcpu->arch fields and potentially neighboring slab objects; per kernel guidance this out-of-bounds memory corruption is leverageable for host kernel information disclosure.

I:HIntegrity impact, high

The attacker fully controls the bit index via the irq argument, yielding controlled out-of-bounds set_bit()/clear_bit() writes across the vCPU kmem_cache allocation that can be steered toward host kernel privilege escalation or code execution.

A:HAvailability impact, high

Corrupting irq_pending-adjacent kvm_vcpu_arch state or memory beyond the vCPU object can immediately oops or panic the host kernel when the vCPU runs or on subsequent KVM operations, constituting high availability impact.