Critical 9.0Published Jul 19, 2026

CVE-2026-64106KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

Updated under an hour ago (Oct 27, 2026, 2:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid_bits. Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic_its_restore_itt(), where the unchecked value can be converted into an oversized scan_its_table() range.

CVSS: 9.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
Weakness (CWE): CWE-20
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 57a9a117154c93539e33161dd318e6aeb8c04efa before 1716b7fea2ead941a0dfac06c4504a3437cdf00d; from 57a9a117154c93539e33161dd318e6aeb8c04efa before dab9f93251b2c86a033de6098d0c73afddd55d4a; from 57a9a117154c93539e33161dd318e6aeb8c04efa before b94538186a3eae3763b8f96dacd610920a865aa7; from 57a9a117154c93539e33161dd318e6aeb8c04efa before 0680f511926589206f81f57f76ce131d7741a316; 57a9a117154c93539e33161dd318e6aeb8c04efa builds before 8bcd15b690a390241179516af1b6ae49ebfd9d95; 57a9a117154c93539e33161dd318e6aeb8c04efa builds before 9ce754ed8e7ab4e3999767ce1505f85c449ccb07	CNA record
linux linux_kernel linux:linux_kernel	from 4.12 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; 7.1; 7.1; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/1716b7fea2ead941a0dfac06c4504a3437cdf00d	patch
https://git.kernel.org/stable/c/dab9f93251b2c86a033de6098d0c73afddd55d4a	patch
https://git.kernel.org/stable/c/b94538186a3eae3763b8f96dacd610920a865aa7	patch
https://git.kernel.org/stable/c/0680f511926589206f81f57f76ce131d7741a316	patch
https://git.kernel.org/stable/c/8bcd15b690a390241179516af1b6ae49ebfd9d95	patch
https://git.kernel.org/stable/c/9ce754ed8e7ab4e3999767ce1505f85c449ccb07	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.