Junglewise Threat Intelligence

CVE-2026-64282: Linux Kernel KVM memory leak in kvm_translate_vncr on arm64

CVE-2026-64282 · Severity: info · CVSS 2.1 · Published 2026-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's virtualization component (KVM) for ARM64 systems. Under specific conditions, the system fails to properly release memory references during a race condition. This can lead to a memory leak, which over time may degrade system performance or cause stability issues for the host operating system.

Technical details

A resource leak exists in arch/arm64/kvm/nested.c within the Linux kernel. The function kvm_translate_vncr() fails to release a reference on a faulted-in Page Frame Number (PFN) when it encounters a race condition with an MMU notifier. Specifically, when mmu_invalidate_retry() triggers an early return, the code does not call kvm_release_faultin_page(), leading to a reference leak. This issue affects ARM64 systems utilizing nested virtualization. Patches have been released for various stable branches including 6.18.39 and 7.1.4.

Affected products

  • Linux Linux Kernel 6.16 to 6.18.39, 7.1.4

Timeline

  • 2026-07-25: disclosed
  • 2026-07-25: advisory

References

Related threats