CVE-2026-64105: KVM: arm64: vgic: Free private_irqs when init fails after allocation

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic: Free private_irqs when init fails after allocation

Companion to commit 250f25367b58 ("KVM: arm64: Tear down vGIC on
failed vCPU creation"), which added the missing kvm_vgic_vcpu_destroy()
call to the kvm_share_hyp() failure path in kvm_arch_vcpu_create(). The
kvm_vgic_vcpu_init() failure path immediately above it has the same
shape and still needs the same cleanup.

Call kvm_vgic_vcpu_destroy() when kvm_vgic_vcpu_init() fails so private
IRQs allocated before a redistributor iodev registration failure are
released before the failed vCPU is freed.

The Linux kernel CVE team has assigned CVE-2026-64105 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.10 with commit 03b3d00a70b55857439511c1b558ca00a99f4126 and fixed in 6.12.92 with commit 173fb86e5519dbe7aabed1f5fa7456152a4a2e38
	Issue introduced in 6.10 with commit 03b3d00a70b55857439511c1b558ca00a99f4126 and fixed in 6.18.34 with commit 7023900b4988fb6f4a59d304d878003ff562e98d
	Issue introduced in 6.10 with commit 03b3d00a70b55857439511c1b558ca00a99f4126 and fixed in 7.0.11 with commit e690caa54a6139d98495ac69626807623520babd
	Issue introduced in 6.10 with commit 03b3d00a70b55857439511c1b558ca00a99f4126 and fixed in 7.1 with commit f19c354dbd457759dfcf1195ab4bdba2bb568323

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64105
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/arm64/kvm/arm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/173fb86e5519dbe7aabed1f5fa7456152a4a2e38
	https://git.kernel.org/stable/c/7023900b4988fb6f4a59d304d878003ff562e98d
	https://git.kernel.org/stable/c/e690caa54a6139d98495ac69626807623520babd
	https://git.kernel.org/stable/c/f19c354dbd457759dfcf1195ab4bdba2bb568323