CVE-2026-64286

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM arm64 implementation where the flush hyp vcpu() function copies the host vCPU context into the hyp's private vCPU during every run. Because the ctxt to vcpu() function expects the hyp running vcpu variable to be NULL in a guest context to resolve the vCPU via container of(), the verbatim copy performed by flush hyp vcpu() allows a value provided by the host to be dereferenced at EL2 (Exception Level 2, a privileged processor mode for hypervisors).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.