CVE-2026-64106
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel's KVM for ARM64, a vulnerability was found in the emulated ITS (Interrupt Translation Service) controller. The function restoring Device Table Entries (DTE) did not validate the number of EventID bits, allowing restoration of an out-of-range value larger than supported by the virtual ITS.
Risk Assessment
An attacker with virtual machine management privileges (e.g., via QEMU/KVM interface) can restore an invalid ITS state, potentially leading to out-of-bounds memory read during ITT table scanning, causing guest system crash or information leak.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit 5e3e5c1f8c9b). If update is not possible, temporarily disable ITS state migration for ARM64 virtual machines.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid_bits. Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic_its_restore_itt(), where the unchecked value can be converted into an oversized scan_its_table() range.