CVE-2026-64287 Details
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use used_lrs as their loop bound and expect it to stay within the number of implemented list registers. While this is generally the case, flush_hyp_vcpu() copies vgic_v3 verbatim and does not enforce this, so a value provided by the host is used at EL2 to index vgic_lr[] and access ICH_LR<n>_EL2 (host -> EL2). Fix by clamping used_lrs to the number of implemented list registers after the copy, as the trusted path already does in vgic_flush_lr_state(). The number of implemented list registers is constant after init, so it is replicated once from kvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on every entry.
A vulnerability exists in the Linux kernel's KVM for arm64 architecture, specifically within the handling of virtual CPU (vCPU) state management. The issue arises in the flush_hyp_vcpu() function, which transfers the host's virtual Generic Interrupt Controller (vGIC) state to the hypervisor's private vCPU on each execution. This process, however, does not properly validate the number of list registers used, potentially allowing a value from the host to incorrectly index the vGIC list registers at the hypervisor level. As a result, the vulnerability could lead to improper access or manipulation of interrupt handling registers, which are crucial for managing virtualized CPU interrupts effectively.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. The specific commit that resolves this issue is available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8 | kernel.org | Patch |
| https://git.kernel.org/stable/c/7fca3fcef81c713bc82a37bf741e0f28e6d04a6f | kernel.org | Patch |
| https://git.kernel.org/stable/c/8cc8bbbfab14c22c5551d0dd19b208a44b141c76 | kernel.org | Patch |
| https://git.kernel.org/stable/c/9fa301d8298778dd799fa4dcf7a7f440715d146e | kernel.org | Patch |
| https://git.kernel.org/stable/c/c646431865f4b1a5b14067233fa27b11e05e0d46 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.2, < 6.6.145 >= 6.7, < 6.12.97 >= 6.13, < 6.18.40 >= 6.19, < 7.1.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | CVE Modified | kernel.org |
| Aug 13, 2026 | Initial Analysis | [email protected] |
| Jul 27, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |