CVE-2026-64247

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.1.0-rc2

Description An issue exists in the KVM x86 hyper-v component where the bank index is not properly bounded when querying sparse banks. When handling a paravirtual TLB (Translation Lookaside Buffer) flush for L2, the VP ID is copied from the enlightened VMCS without a bounds check, meaning it is not guaranteed to be under the limit of 4096. This lack of validation leads to an out-of-bounds read when testing the sparse bank in the hv is vp in sparse set() function, which could result in KVM performing an unnecessary TLB flush for an L2 vCPU.

Recommendations Update the Linux kernel to a version where the bank index is explicitly bounded when querying sparse banks and a compile-time assertion is added to ensure the maximum number of sparse banks matches the bits in the passed mask.