PT-2026-61423 · Linux · Linux

CVE-2026-64106 · Publicado 2026-07-19 · Atualizado 2026-07-19

Mitre

CVSS v3.1

9.0

Crítica

Vetor base

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-its: Reject restored DTE with out-of-range num eventid bits

Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic its restore dte() accepts it and stores the out-of-range value in dev->num eventid bits.

Reject restored DTEs with num eventid bits > VITS TYPER IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic its restore itt(), where the unchecked value can be converted into an oversized scan its table() range.

Correção

Identificadores relacionados

CVE-2026-64106

Produtos afetados

Linux

Referências · 7

• https://git.kernel.org/stable/c/dab9f93251b2c86a033de6098d0c73afddd55d4a · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-64106 · Nota de Segurança
• https://git.kernel.org/stable/c/1716b7fea2ead941a0dfac06c4504a3437cdf00d · Nota
• https://git.kernel.org/stable/c/0680f511926589206f81f57f76ce131d7741a316 · Nota
• https://git.kernel.org/stable/c/8bcd15b690a390241179516af1b6ae49ebfd9d95 · Nota
• https://git.kernel.org/stable/c/9ce754ed8e7ab4e3999767ce1505f85c449ccb07 · Nota
• https://git.kernel.org/stable/c/b94538186a3eae3763b8f96dacd610920a865aa7 · Nota