CVE-2026-64106

KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

State: Published
Severity: 9.0 Critical
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid_bits.

Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic_its_restore_itt(), where the unchecked value can be converted into an oversized scan_its_table() range.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H	Linux

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
LinuxLinux	57a9a117154c93539e33161dd318e6aeb8c04efa to before 1716b7fea2ead941a0dfac06c4504a3437cdf00dAffected 57a9a117154c93539e33161dd318e6aeb8c04efa to before dab9f93251b2c86a033de6098d0c73afddd55d4aAffected 57a9a117154c93539e33161dd318e6aeb8c04efa to before b94538186a3eae3763b8f96dacd610920a865aa7Affected 57a9a117154c93539e33161dd318e6aeb8c04efa to before 0680f511926589206f81f57f76ce131d7741a316Affected 57a9a117154c93539e33161dd318e6aeb8c04efa to before 8bcd15b690a390241179516af1b6ae49ebfd9d95Affected 57a9a117154c93539e33161dd318e6aeb8c04efa to before 9ce754ed8e7ab4e3999767ce1505f85c449ccb07Affected
LinuxLinux	4.12Affected before 4.12Not affected 6.1.175 through 6.1.Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

57a9a117154c93539e33161dd318e6aeb8c04efa to before 1716b7fea2ead941a0dfac06c4504a3437cdf00dAffected
57a9a117154c93539e33161dd318e6aeb8c04efa to before dab9f93251b2c86a033de6098d0c73afddd55d4aAffected
57a9a117154c93539e33161dd318e6aeb8c04efa to before b94538186a3eae3763b8f96dacd610920a865aa7Affected
57a9a117154c93539e33161dd318e6aeb8c04efa to before 0680f511926589206f81f57f76ce131d7741a316Affected
57a9a117154c93539e33161dd318e6aeb8c04efa to before 8bcd15b690a390241179516af1b6ae49ebfd9d95Affected
57a9a117154c93539e33161dd318e6aeb8c04efa to before 9ce754ed8e7ab4e3999767ce1505f85c449ccb07Affected

LinuxLinux

4.12Affected
before 4.12Not affected
6.1.175 through 6.1.*Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.