{"id":"CVE-2026-64287","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU\n\nflush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU\non every run","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU\n\nflush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU\non every run. The vGIC list register…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","published":"2026-07-25","updated":"2026-07-27","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64287","references":[{"url":"https://git.kernel.org/stable/c/2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7fca3fcef81c713bc82a37bf741e0f28e6d04a6f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8cc8bbbfab14c22c5551d0dd19b208a44b141c76","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9fa301d8298778dd799fa4dcf7a7f440715d146e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c646431865f4b1a5b14067233fa27b11e05e0d46","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64287.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64287"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507129"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64287"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64287"},{"url":"https://lore.kernel.org/linux-cve-announce/2026072503-CVE-2026-64287-ea42@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:64808"},{"url":"https://access.redhat.com/errata/RHSA-2026:64775"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00175,"epssPercentile":0.07272,"ingestedAt":"2026-07-27T06:16:50.117Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS (v. 9)","affected":["enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_9"],"patched":["enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_9"],"cwe":["CWE-125"],"scores":{"nvd":8.2,"vendor":7},"slug":"CVE-2026-64287","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU\n\nflush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU\non every run. The vGIC list register save and restore use used_lrs as\ntheir loop bound and expect it to stay within the number of implemented\nlist registers. While this is generally the case, flush_hyp_vcpu()\ncopies vgic_v3 verbatim and does not enforce this, so a value provided\nby the host is used at EL2 to index vgic_lr[] and access ICH_LR<n>_EL2\n(host -> EL2).\n\nFix by clamping used_lrs to the number of implemented list registers\nafter the copy, as the trusted path already does in\nvgic_flush_lr_state(). The number of implemented list registers is\nconstant after init, so it is replicated once from\nkvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on\nevery entry.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:64808** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64808)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64287.json)\n- **RHSA-2026:64775** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64775)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}