CVE-2026-64287

CVE CVE-2026-64287EUVD EUVD-2026-48999Published 2026-07-25T08:49:28.000ZLast changed 2026-08-05T12:40:38.000ZCVSS 8.2

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use used_lrs as their loop bound and expect it to stay within the number of implemented list registers. While this is generally the case, flush_hyp_vcpu() copies vgic_v3 verbatim and does not enforce this, so a value provided by the host is used at EL2 to index vgic_lr[] and access ICH_LR<n>_EL2 (host -> EL2). Fix by clamping used_lrs to the number of implemented list registers after the copy, as the trusted path already does in vgic_flush_lr_state(). The number of implemented list registers is constant after init, so it is replicated once from kvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on every entry.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux be66e67f175096f283c9d5614c4991fc9e7ed975 <c646431865f4b1a5b14067233fa27b11e05e0d46; patch: 0; patch: 6.12.97; be66e67f175096f283c9d5614c4991fc9e7ed975 <9fa301d8298778dd799fa4dcf7a7f440715d146e; 6.2; be66e67f175096f283c9d5614c4991fc9e7ed975 <8cc8bbbfab14c22c5551d0dd19b208a44b141c76; be66e67f175096f283c9d5614c4991fc9e7ed975 <2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8; patch: 7.2-rc1; be66e67f175096f283c9d5614c4991fc9e7ed975 <7fca3fcef81c713bc82a37bf741e0f28e6d04a6f; patch: 6.18.40; patch: 7.1.4; patch: 6.6.145

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.