Junglewise Threat Intelligence

CVE-2026-64106: Linux Kernel KVM validation failure in arm64 vgic-its

CVE-2026-64106 · Severity: info · CVSS 0 · Published 2026-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's virtualization component (KVM) for ARM64 systems could allow a malicious user to provide invalid configuration data when restoring a virtual machine. This flaw affects the Interrupt Translation Service (ITS), which manages hardware interrupts for virtualized devices. If exploited, it could lead to memory management issues or system instability within the host environment.

Technical details

A vulnerability exists in the vgic-its component of the Linux kernel's KVM implementation for arm64. The function vgic_its_restore_dte() fails to validate the num_eventid_bits field against the supported VITS_TYPER_IDBITS limit when userspace restores an ITS Device Table Entry. This lack of validation allows an out-of-range value to be stored in dev->num_eventid_bits, which is subsequently used in vgic_its_restore_itt(). An attacker with the ability to restore VM state (typically a local userspace process with KVM access) could provide a crafted DTE to trigger an oversized scan_its_table() range, potentially leading to out-of-bounds memory access or a kernel crash. The issue has been addressed by adding a check to reject restored DTEs with invalid EventID bits.

Affected products

  • Linux Linux Kernel 4.12 to 7.1

Timeline

  • 2026-05-19: disclosed: Initial patch submission by Michael Bommarito
  • 2026-06-01: patched: Patch committed to stable trees by Greg Kroah-Hartman
  • 2026-07-19: advisory: CVE-2026-64106 published in NVD

References

Related threats