PT-2026-61423 · Linux · Linux

CVE-2026-64106 · Published 2026-07-19 · Updated 2026-07-19

Mitre

CVSS v3.1

9.0

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-its: Reject restored DTE with out-of-range num eventid bits

Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic its restore dte() accepts it and stores the out-of-range value in dev->num eventid bits.

Reject restored DTEs with num eventid bits > VITS TYPER IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic its restore itt(), where the unchecked value can be converted into an oversized scan its table() range.

Fix

Related Identifiers

CVE-2026-64106

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-64106 · Security Note
• https://git.kernel.org/stable/c/dab9f93251b2c86a033de6098d0c73afddd55d4a · Note
• https://git.kernel.org/stable/c/1716b7fea2ead941a0dfac06c4504a3437cdf00d · Note
• https://git.kernel.org/stable/c/0680f511926589206f81f57f76ce131d7741a316 · Note
• https://git.kernel.org/stable/c/8bcd15b690a390241179516af1b6ae49ebfd9d95 · Note
• https://git.kernel.org/stable/c/9ce754ed8e7ab4e3999767ce1505f85c449ccb07 · Note
• https://git.kernel.org/stable/c/b94538186a3eae3763b8f96dacd610920a865aa7 · Note