CVE-2026-64287
Received Received - Intake

KVM: arm64 Hypervisor Use-After-Free in vGIC State Handling

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use used_lrs as their loop bound and expect it to stay within the number of implemented list registers. While this is generally the case, flush_hyp_vcpu() copies vgic_v3 verbatim and does not enforce this, so a value provided by the host is used at EL2 to index vgic_lr[] and access ICH_LR<n>_EL2 (host -> EL2). Fix by clamping used_lrs to the number of implemented list registers after the copy, as the trusted path already does in vgic_flush_lr_state(). The number of implemented list registers is constant after init, so it is replicated once from kvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on every entry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64287
EUVD
EUVD-2026-48999

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the KVM (Kernel-based Virtual Machine) implementation for arm64 systems. The issue occurs in the flush_hyp_vcpu() function, which copies the host vGIC (Virtual Generic Interrupt Controller) state into the hypervisor's private vCPU during each run. The function incorrectly uses a value from the host (used_lrs) to index into the vgic_lr array without ensuring it stays within the bounds of implemented list registers. This could lead to out-of-bounds access in the ICH_LR<n>_EL2 register.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation for arm64 systems. Detection requires checking the kernel version and KVM configuration. Use 'uname -a' to verify the kernel version and 'lsmod | grep kvm' to confirm KVM modules are loaded. Monitor kernel logs for errors related to vGIC or KVM operations.

Impact Analysis

This vulnerability could allow a malicious guest VM to potentially execute arbitrary code or cause a denial of service in the hypervisor (EL2) by exploiting the out-of-bounds access. This could lead to VM escape, where an attacker gains control over the host system or other guest VMs running on the same host.

Mitigation Strategies

Apply the latest kernel update provided by your distribution to patch the vulnerability. If immediate patching is not possible, disable KVM for arm64 by unloading the kvm-arm64 module with 'rmmod kvm-arm64'. Ensure virtualization is not required for critical services during this period.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64287. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart