---
id: CVE-2026-64106
title: 'KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

  Userspace can restore an ITS Device Table Entry whose Size field encodes
  more EventID bits…
severity: critical
cvss: 9
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 57a9a117154c93539e33161dd318e6aeb8c04efa <
    1716b7fea2ead941a0dfac06c4504a3437cdf00d
  - >-
    Linux >= 57a9a117154c93539e33161dd318e6aeb8c04efa <
    dab9f93251b2c86a033de6098d0c73afddd55d4a
  - >-
    Linux >= 57a9a117154c93539e33161dd318e6aeb8c04efa <
    b94538186a3eae3763b8f96dacd610920a865aa7
  - >-
    Linux >= 57a9a117154c93539e33161dd318e6aeb8c04efa <
    0680f511926589206f81f57f76ce131d7741a316
  - >-
    Linux >= 57a9a117154c93539e33161dd318e6aeb8c04efa <
    8bcd15b690a390241179516af1b6ae49ebfd9d95
  - >-
    Linux >= 57a9a117154c93539e33161dd318e6aeb8c04efa <
    9ce754ed8e7ab4e3999767ce1505f85c449ccb07
  - Linux 4.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:36:21.559565Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:22.327Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64106'
references:
  - url: 'https://git.kernel.org/stable/c/1716b7fea2ead941a0dfac06c4504a3437cdf00d'
  - url: 'https://git.kernel.org/stable/c/dab9f93251b2c86a033de6098d0c73afddd55d4a'
  - url: 'https://git.kernel.org/stable/c/b94538186a3eae3763b8f96dacd610920a865aa7'
  - url: 'https://git.kernel.org/stable/c/0680f511926589206f81f57f76ce131d7741a316'
  - url: 'https://git.kernel.org/stable/c/8bcd15b690a390241179516af1b6ae49ebfd9d95'
  - url: 'https://git.kernel.org/stable/c/9ce754ed8e7ab4e3999767ce1505f85c449ccb07'
tags:
  - cve.org
epss: 0.00148
epssPercentile: 0.0362
ingestedAt: '2026-10-16T17:24:46.804Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

Userspace can restore an ITS Device Table Entry whose Size field encodes
more EventID bits than the virtual ITS supports.  The live MAPD path
rejects that state, but vgic_its_restore_dte() accepts it and stores the
out-of-range value in dev->num_eventid_bits.

Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before
allocating the device.  This mirrors the MAPD check and prevents the
restored state from reaching vgic_its_restore_itt(), where the unchecked
value can be converted into an oversized scan_its_table() range.

## Affected

- `Linux >= 57a9a117154c93539e33161dd318e6aeb8c04efa < 1716b7fea2ead941a0dfac06c4504a3437cdf00d`
- `Linux >= 57a9a117154c93539e33161dd318e6aeb8c04efa < dab9f93251b2c86a033de6098d0c73afddd55d4a`
- `Linux >= 57a9a117154c93539e33161dd318e6aeb8c04efa < b94538186a3eae3763b8f96dacd610920a865aa7`
- `Linux >= 57a9a117154c93539e33161dd318e6aeb8c04efa < 0680f511926589206f81f57f76ce131d7741a316`
- `Linux >= 57a9a117154c93539e33161dd318e6aeb8c04efa < 8bcd15b690a390241179516af1b6ae49ebfd9d95`
- `Linux >= 57a9a117154c93539e33161dd318e6aeb8c04efa < 9ce754ed8e7ab4e3999767ce1505f85c449ccb07`
- `Linux 4.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.