CVE-2026-64282

Analyzed Analyzed - Analysis Complete

Memory Leak in Linux Kernel KVM

Publication date: 2026-07-25

Last updated on: 2026-08-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier In the case that kvm_translate_vncr() races with an MMU notifier the early return does not release a reference on the faulted in PFN. Add the necessary call to kvm_release_faultin_page() for the unused PFN.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64282

EUVD

EUVD-2026-48994

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 6.16 (inc) to 6.18.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the KVM (Kernel-based Virtual Machine) arm64 component. It occurs when a race condition happens between kvm_translate_vncr() and an MMU notifier. The issue causes a reference to a faulted-in page frame number (PFN) not being released, potentially leading to a memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation for arm64 and involves a race condition with MMU notifiers. Detection requires kernel-level inspection rather than network commands. Check kernel logs for MMU notifier errors or KVM-related crashes. Use 'dmesg | grep -i kvm' or 'dmesg | grep -i mmu' to search for related errors. Ensure your kernel version is patched by running 'uname -r' and comparing against the fixed version.

Impact Analysis

The vulnerability could lead to memory leaks in the host system, potentially causing resource exhaustion or instability. If exploited, it might allow an attacker with local access to trigger a denial-of-service condition on the affected system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory management issue without clear implications for data protection or privacy regulations.

Mitigation Strategies

Apply the latest Linux kernel patches to address the KVM arm64 vulnerability. Monitor for updates from your Linux distribution vendor and ensure all systems are updated promptly.

Hi! I’m here to help you understand CVE-2026-64282. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70