In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic: Check the interrupt is still ours before migrating it

vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating
an interrupt to another vCPU. After reacquiring the locks it only checks
that the affinity is unchanged (target_vcpu == vgic_target_oracle(irq))
before moving the interrupt, which assumes that an interrupt whose affinity
is preserved is still queued on this vCPU's ap_list.

That assumption no longer holds if the interrupt is taken off the ap_list
while the locks are dropped. vgic_flush_pending_lpis() removes the
interrupt from the list and sets irq->vcpu to NULL, but leaves
enabled/pending/target_vcpu untouched. As the interrupt is still enabled
and pending, vgic_target_oracle() returns the same target_vcpu, so the
affinity check passes and list_del() is run a second time on an entry that
has already been removed.

Also check that the interrupt is still assigned to this vCPU
(irq->vcpu == vcpu) before moving it.

https://git.kernel.org/stable/c/0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe

https://git.kernel.org/stable/c/0658b09cba7fe866c6cd70cd2dcdfdcabe80328f

https://git.kernel.org/stable/c/3893e1fcf6f306b327a8358dcd1cbd077989a240

https://git.kernel.org/stable/c/654be81c4c637af12709d47c7efc3302cd336513

https://git.kernel.org/stable/c/79fdd2aa774e44847cd9bb7edc811e73e3dc7bfe

https://git.kernel.org/stable/c/cb3efe1a354f1638726725c3ecee1ce8d1a7e2dc

https://git.kernel.org/stable/c/da2d249a39a1881681c303ceea33f38ba1c5bbeb

https://git.kernel.org/stable/c/e363c0bc0226dc5ea5046a88e9a6864b82c45399

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/kvm/vgic/vgic.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0919e84c0fc1fc73525fdcedefab89ea8460f697","lessThan":"3893e1fcf6f306b327a8358dcd1cbd077989a240","versionType":"git","status":"affected"},{"version":"0919e84c0fc1fc73525fdcedefab89ea8460f697","lessThan":"cb3efe1a354f1638726725c3ecee1ce8d1a7e2dc","versionType":"git","status":"affected"},{"version":"0919e84c0fc1fc73525fdcedefab89ea8460f697","lessThan":"da2d249a39a1881681c303ceea33f38ba1c5bbeb","versionType":"git","status":"affected"},{"version":"0919e84c0fc1fc73525fdcedefab89ea8460f697","lessThan":"654be81c4c637af12709d47c7efc3302cd336513","versionType":"git","status":"affected"},{"version":"0919e84c0fc1fc73525fdcedefab89ea8460f697","lessThan":"e363c0bc0226dc5ea5046a88e9a6864b82c45399","versionType":"git","status":"affected"},{"version":"0919e84c0fc1fc73525fdcedefab89ea8460f697","lessThan":"79fdd2aa774e44847cd9bb7edc811e73e3dc7bfe","versionType":"git","status":"affected"},{"version":"0919e84c0fc1fc73525fdcedefab89ea8460f697","lessThan":"0658b09cba7fe866c6cd70cd2dcdfdcabe80328f","versionType":"git","status":"affected"},{"version":"0919e84c0fc1fc73525fdcedefab89ea8460f697","lessThan":"0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/kvm/vgic/vgic.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc4","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]