CVE-2026-64287 (GCVE-0-2026-64287)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
Title
KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use used_lrs as their loop bound and expect it to stay within the number of implemented list registers. While this is generally the case, flush_hyp_vcpu() copies vgic_v3 verbatim and does not enforce this, so a value provided by the host is used at EL2 to index vgic_lr[] and access ICH_LR<n>_EL2 (host -> EL2). Fix by clamping used_lrs to the number of implemented list registers after the copy, as the trusted path already does in vgic_flush_lr_state(). The number of implemented list registers is constant after init, so it is replicated once from kvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on every entry.
Severity
8.2 (High)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: be66e67f175096f283c9d5614c4991fc9e7ed975 , < 2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8 (git)
Affected: be66e67f175096f283c9d5614c4991fc9e7ed975 , < 9fa301d8298778dd799fa4dcf7a7f440715d146e (git)
Affected: be66e67f175096f283c9d5614c4991fc9e7ed975 , < c646431865f4b1a5b14067233fa27b11e05e0d46 (git)
Affected: be66e67f175096f283c9d5614c4991fc9e7ed975 , < 7fca3fcef81c713bc82a37bf741e0f28e6d04a6f (git)
Affected: be66e67f175096f283c9d5614c4991fc9e7ed975 , < 8cc8bbbfab14c22c5551d0dd19b208a44b141c76 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_hyp.h",
            "arch/arm64/kvm/arm.c",
            "arch/arm64/kvm/hyp/nvhe/hyp-main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8",
              "status": "affected",
              "version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
              "versionType": "git"
            },
            {
              "lessThan": "9fa301d8298778dd799fa4dcf7a7f440715d146e",
              "status": "affected",
              "version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
              "versionType": "git"
            },
            {
              "lessThan": "c646431865f4b1a5b14067233fa27b11e05e0d46",
              "status": "affected",
              "version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
              "versionType": "git"
            },
            {
              "lessThan": "7fca3fcef81c713bc82a37bf741e0f28e6d04a6f",
              "status": "affected",
              "version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
              "versionType": "git"
            },
            {
              "lessThan": "8cc8bbbfab14c22c5551d0dd19b208a44b141c76",
              "status": "affected",
              "version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_hyp.h",
            "arch/arm64/kvm/arm.c",
            "arch/arm64/kvm/hyp/nvhe/hyp-main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU\n\nflush_hyp_vcpu() copies the host vGIC state into the hyp\u0027s private vCPU\non every run. The vGIC list register save and restore use used_lrs as\ntheir loop bound and expect it to stay within the number of implemented\nlist registers. While this is generally the case, flush_hyp_vcpu()\ncopies vgic_v3 verbatim and does not enforce this, so a value provided\nby the host is used at EL2 to index vgic_lr[] and access ICH_LR\u003cn\u003e_EL2\n(host -\u003e EL2).\n\nFix by clamping used_lrs to the number of implemented list registers\nafter the copy, as the trusted path already does in\nvgic_flush_lr_state(). The number of implemented list registers is\nconstant after init, so it is replicated once from\nkvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on\nevery entry."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A malicious or compromised arm64 EL1 host reaches the flaw through the local KVM vCPU-run hypercall into pKVM EL2. No network or adjacent protocol directly controls this internal field.\nAC:L - On a pKVM/GICv3 system, the host can directly select an oversized used_lrs value and deterministically trigger the unchecked loops. No race or condition outside the attacker\u0027s control is required.\nPR:H - Normal KVM paths keep used_lrs hardware-bounded, and neither an unprivileged KVM user nor a user namespace can assign it directly. Exploitation requires control of the host kernel at EL1, equivalent to real administrative privileges.\nUI:N - The malicious host can load and run a vCPU itself without any action by a protected-VM user or another victim.\nS:C - Exploitation crosses pKVM\u0027s EL1-host-to-EL2 isolation boundary and can affect hypervisor-private state and protected VMs outside the host\u0027s security authority.\nC:H - The restore and synchronization paths can read beyond vgic_lr[] and transfer hyp-private vCPU data back into host-visible memory. EL2 compromise could expose protected-VM memory and other hypervisor secrets.\nI:H - The save path writes beyond vgic_lr[] into adjacent hyp-private vCPU metadata, including pointer, lock, and list state. This memory corruption is plausibly usable for EL2 control-flow hijacking and protected-VM modification.\nA:H - Large bounds can cause extensive loops, invalid EL2 memory accesses, or corruption of critical hypervisor metadata. An nVHE hypervisor panic explicitly escalates to a host kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:43.106Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fa301d8298778dd799fa4dcf7a7f440715d146e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c646431865f4b1a5b14067233fa27b11e05e0d46"
        },
        {
          "url": "https://git.kernel.org/stable/c/7fca3fcef81c713bc82a37bf741e0f28e6d04a6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8cc8bbbfab14c22c5551d0dd19b208a44b141c76"
        }
      ],
      "title": "KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64287",
    "datePublished": "2026-07-25T08:49:28.168Z",
    "dateReserved": "2026-07-19T15:36:31.778Z",
    "dateUpdated": "2026-08-17T04:52:43.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64287",
      "date": "2026-10-05",
      "epss": "0.00175",
      "percentile": "0.06302"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:41:03.000Z",
      "cve": "CVE-2026-64287",
      "id": "msrc_CVE-2026-64287",
      "initial_release_date": "2026-07-26T01:10:33.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64287.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/arm64/include/asm/kvm_hyp.h",
                  "arch/arm64/kvm/arm.c",
                  "arch/arm64/kvm/hyp/nvhe/hyp-main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8",
                    "status": "affected",
                    "version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9fa301d8298778dd799fa4dcf7a7f440715d146e",
                    "status": "affected",
                    "version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c646431865f4b1a5b14067233fa27b11e05e0d46",
                    "status": "affected",
                    "version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7fca3fcef81c713bc82a37bf741e0f28e6d04a6f",
                    "status": "affected",
                    "version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8cc8bbbfab14c22c5551d0dd19b208a44b141c76",
                    "status": "affected",
                    "version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/arm64/include/asm/kvm_hyp.h",
                  "arch/arm64/kvm/arm.c",
                  "arch/arm64/kvm/hyp/nvhe/hyp-main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.2"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE",
                    "versionEndExcluding": "6.6.145",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "05880CF6-5AD2-44E9-853A-6CE8318E76A5",
                    "versionEndExcluding": "6.12.97",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "67D87928-1419-4529-9201-42C059678CB4",
                    "versionEndExcluding": "6.18.40",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU\n\nflush_hyp_vcpu() copies the host vGIC state into the hyp\u0027s private vCPU\non every run. The vGIC list register save and restore use used_lrs as\ntheir loop bound and expect it to stay within the number of implemented\nlist registers. While this is generally the case, flush_hyp_vcpu()\ncopies vgic_v3 verbatim and does not enforce this, so a value provided\nby the host is used at EL2 to index vgic_lr[] and access ICH_LR\u003cn\u003e_EL2\n(host -\u003e EL2).\n\nFix by clamping used_lrs to the number of implemented list registers\nafter the copy, as the trusted path already does in\nvgic_flush_lr_state(). The number of implemented list registers is\nconstant after init, so it is replicated once from\nkvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on\nevery entry."
          }
        ],
        "id": "CVE-2026-64287",
        "lastModified": "2026-08-17T05:17:28.150",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.5,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:09.353",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7fca3fcef81c713bc82a37bf741e0f28e6d04a6f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8cc8bbbfab14c22c5551d0dd19b208a44b141c76"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9fa301d8298778dd799fa4dcf7a7f440715d146e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c646431865f4b1a5b14067233fa27b11e05e0d46"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-02T00:40:12+00:00",
      "cve": "CVE-2026-64287",
      "id": "CVE-2026-64287",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "70",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64287.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-03T00:47:15Z",
      "cve": "CVE-2026-64287",
      "id": "CVE-2026-64287",
      "initial_release_date": "2026-07-25T16:46:32Z",
      "product_status:known_affected": "484",
      "product_status:known_not_affected": "251",
      "product_status:recommended": "339",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64287",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64287.json",
      "version": "14"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.