CVE-2026-64106
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid_bits. Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic_its_restore_itt(), where the unchecked value can be converted into an oversized scan_its_table() range.
- CVSS 3.1
- 9.0 CRITICALCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
- EPSS
- 0.15% probability · 4th percentile
- CISA KEV
- Not listed
- Affected
- linux/linux kernel
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
References
- https://git.kernel.org/stable/c/0680f511926589206f81f57f76ce131d7741a316Patch
- https://git.kernel.org/stable/c/1716b7fea2ead941a0dfac06c4504a3437cdf00dPatch
- https://git.kernel.org/stable/c/8bcd15b690a390241179516af1b6ae49ebfd9d95Patch
- https://git.kernel.org/stable/c/9ce754ed8e7ab4e3999767ce1505f85c449ccb07Patch
- https://git.kernel.org/stable/c/b94538186a3eae3763b8f96dacd610920a865aa7Patch
- https://git.kernel.org/stable/c/dab9f93251b2c86a033de6098d0c73afddd55d4aPatch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.