CVE-2026-64105
Received Received - Intake

KVM: arm64 vGIC Private IRQ Leak on Initialization Failure

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free private_irqs when init fails after allocation Companion to commit 250f25367b58 ("KVM: arm64: Tear down vGIC on failed vCPU creation"), which added the missing kvm_vgic_vcpu_destroy() call to the kvm_share_hyp() failure path in kvm_arch_vcpu_create(). The kvm_vgic_vcpu_init() failure path immediately above it has the same shape and still needs the same cleanup. Call kvm_vgic_vcpu_destroy() when kvm_vgic_vcpu_init() fails so private IRQs allocated before a redistributor iodev registration failure are released before the failed vCPU is freed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64105
EUVD
EUVD-2026-45790

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability affecting KVM for arm64 systems. It involves a missing cleanup step when initializing virtual CPU (vCPU) interrupt controllers. If the initialization fails after allocating private interrupts, those interrupts are not freed, potentially causing resource leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation for ARM64 systems. Detection requires checking kernel logs for vGIC initialization failures or examining kernel source code for the affected function paths. No direct network detection commands are applicable.

Impact Analysis

The impact is limited to systems using KVM for arm64 virtualization. A failed vCPU creation could lead to memory leaks from unfreed private interrupts, but does not directly cause data breaches or system crashes. The effect is primarily on resource management.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel issue related to memory management in KVM for arm64 systems, specifically involving the cleanup of private IRQs during vCPU initialization failures. There is no indication it impacts data protection or privacy requirements.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. Monitor for kernel updates related to KVM/arm64 vGIC handling. If using a vulnerable kernel version, avoid creating new KVM virtual machines until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64105. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart