CVE-2026-72288 is a use-after-free in KVM's vgic (virtual GIC) subsystem during LPI (Linux Peripheral Interrupt) migration between virtual CPUs. The bug manifests when one vCPU disables an LPI while another vCPU holds a pending reference to that interrupt and a third vCPU initiates migration — the reference count drops while the interrupt is still in-flight, leading to UAF.
The patch contains two components. First, a reference-counting fix: the code now takes a reference to the LPI before dropping locks, preventing the object from being freed while migration is in flight. This is the correct, reactive fix for the UAF.
Second, and more revealing, the patch drops any attempt to preserve the LPI's pending bit during migration. The comment explicitly states: 'there is no expectation that this state is retained, as per the architecture.' This is not a semantic weakening — it is an architectural compliance correction. ARM's specification never guaranteed pending-bit preservation across vCPU migration, and the original code was over-constraining itself by trying to deliver behavior the hardware never promised.
For defenders, the key insight is that this is a hypervisor vulnerability where the traditional exploit-difficulty calculus inverts. CVSS 9.3 correctly captures consequence (kernel UAF in the host), but the usual interpretation of 'narrow timing window' as 'low real-world risk' does not apply here. When the attacker controls the guest OS — which is the intended operational model for KVM — they can construct the precise three-vCPU race condition deliberately rather than relying on chance. The window is narrow but fully controllable from within the guest. Any guest-triggerable UAF in vgic is implicitly a guest-to-host escape vector.
The LPI subsystem was grafted onto the existing vgic design years after the core interrupt controller model stabilized, carrying implicit assumptions from earlier interrupt types. This explains why the pending-bit behavior was never validated against the architecture spec — it was unexamined code that migrated alongside the feature without scrutiny. The UAF exposed what should have been a design-time question: what does the architecture actually guarantee here?
Actionable priorities: (1) patch immediately — the reference-count fix closes the UAF; (2) audit any guest code that depends on LPI pending state surviving migration, as the behavioral change is now documented and intentional; (3) treat any KVM hypervisor compromise as a multi-tenant incident given the guest-to-host trust boundary. The EPSS score of 0.00178 reflects exploit difficulty from outside the host, not from within where the attacker already operates.