PT-2026-64507 · Linux · Linux

CVE-2026-64286 · Published 2026-07-25 · Updated 2026-07-25

NVD

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Clear hyp running vcpu when flushing the pKVM hyp vCPU

flush hyp vcpu() copies the host vCPU context into the hyp's private vCPU on every run. ctxt to vcpu() expects a guest context to have a NULL hyp running vcpu, which is only ever set on the host context, so that it resolves the vCPU via container of(). While this is generally the case, flush hyp vcpu() copies the context verbatim and does not enforce this, so a value provided by the host is dereferenced at EL2 (host -> EL2).

Fix by clearing hyp running vcpu after the copy.

Related Identifiers

CVE-2026-64286

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-64286 · Security Note
• https://git.kernel.org/stable/c/477145860dba4c30f0b4e36f02f4c5291c1c888b · Note
• https://git.kernel.org/stable/c/dfaef40d8a1533940fc1af788d70fce07362b4ce · Note
• https://git.kernel.org/stable/c/6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa · Note
• https://git.kernel.org/stable/c/d4f4d61715d1061ba83b88196a3605662be30750 · Note
• https://git.kernel.org/stable/c/e8042f6e1d7befb2fb6b10a75918642bcd0acf9a · Note