CVE-2026-64286

HighCVSS 8.2/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU

flush_hyp_vcpu() copies the host vCPU context into the hyp's private vCPU on every run. ctxt_to_vcpu() expects a guest context to have a NULL __hyp_running_vcpu, which is only ever set on the host context, so that it resolves the vCPU via container_of(). While this is generally the case, flush_hyp_vcpu() copies the context verbatim and does not enforce this, so a value provided by the host is dereferenced at EL2 (host -> EL2).

Fix by clearing __hyp_running_vcpu after the copy.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-822

Affected software

No affected versions have been published.

Timeline

Published
Jul 25, 2026
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-642878.2In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vCVE-2026-642885.5In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invaCVE-2026-642895.5In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entry_num and entry_lenCVE-2026-64295.3When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first hostCVE-2026-642905.5In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufd_fault_fops_read() On a cCVE-2026-642915.5In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() acceptsCVE-2026-642925.5In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq meCVE-2026-642937.8In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read The bCVE-2026-642945.5In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idCVE-2026-642955.5In the Linux kernel, the following vulnerability has been resolved: mm: page_ext: add count limit to page_ext_iter_next to prevent invalid CVE-2026-642967.8In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfat_find_dir_entry() In exfat_find_dCVE-2026-642975.5In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of module_extend_max_pages() mo
CVE-2026-64286: High severity, CVSS 8.2 | Vulnix