by Kastro
Paper/Archive/CVE-2026-64106

CVE-2026-64106

Linux Linux — KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

EPSS 0.1%CVSS 9.0
critical.is priorityof 100
28
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 4.0.040 × 200.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid_bits. Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic_its_restore_itt(), where the unchecked value can be converted into an oversized scan_its_table() range.

Affected

ProductAffectedFixed inSource
Linux57a9a117154c93539e33161dd318e6aeb8c04efa – < 1716b7fea2ead941a0dfac06c4504a3437cdf00d1716b7fea2ead941a0dfac06c4504a3437cdf00dCNA
Linux57a9a117154c93539e33161dd318e6aeb8c04efa – < dab9f93251b2c86a033de6098d0c73afddd55d4adab9f93251b2c86a033de6098d0c73afddd55d4aCNA
Linux57a9a117154c93539e33161dd318e6aeb8c04efa – < b94538186a3eae3763b8f96dacd610920a865aa7b94538186a3eae3763b8f96dacd610920a865aa7CNA
Linux57a9a117154c93539e33161dd318e6aeb8c04efa – < 0680f511926589206f81f57f76ce131d7741a3160680f511926589206f81f57f76ce131d7741a316CNA
Linux57a9a117154c93539e33161dd318e6aeb8c04efa – < 8bcd15b690a390241179516af1b6ae49ebfd9d958bcd15b690a390241179516af1b6ae49ebfd9d95CNA
Linux57a9a117154c93539e33161dd318e6aeb8c04efa – < 9ce754ed8e7ab4e3999767ce1505f85c449ccb079ce754ed8e7ab4e3999767ce1505f85c449ccb07CNA
Linux4.12–CNA

Scores by source

Linux (CNA)9.0CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgit.kernel.org/stable/c/1716b7fea2ead941a0dfac06c4504a3437cdf00drefgit.kernel.org/stable/c/dab9f93251b2c86a033de6098d0c73afddd55d4arefgit.kernel.org/stable/c/b94538186a3eae3763b8f96dacd610920a865aa7refgit.kernel.org/stable/c/0680f511926589206f81f57f76ce131d7741a316refgit.kernel.org/stable/c/8bcd15b690a390241179516af1b6ae49ebfd9d95refgit.kernel.org/stable/c/9ce754ed8e7ab4e3999767ce1505f85c449ccb07