CVE-2026-64287

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the KVM arm64 component where the flush hyp vcpu() function copies the host vGIC state into the hyp's private vCPU without validating the used lrs value. Because used lrs is used as a loop bound for saving and restoring vGIC list registers, a value provided by the host can be used at EL2 to index the vgic lr[] array and access ICH LR<n> EL2. This occurs because the function copies vgic v3 verbatim and fails to enforce that the value remains within the number of implemented list registers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.