CVE-2026-64106

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM arm64 vgic-its component where the vgic its restore dte() function fails to validate the Size field of a restored ITS Device Table Entry (DTE). This allows userspace to restore a DTE with more EventID bits than the virtual ITS supports, storing an out-of-range value in dev->num eventid bits. This unchecked value can subsequently be used in vgic its restore itt() to create an oversized range during the scan its table() process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.