Answer in brief
CVE-2026-64106 records a Critical severity (CVSS 9.0) vulnerability in KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=57a9a117154c93539e33161dd318e6aeb8c04efa <1716b7fea2ead941a0dfac06c4504a3437cdf00d || >=57a9a117154c93539e33161dd318e6aeb8c04efa <dab9f93251b2c86a033de6098d0c73afddd55d4a || >=57a9a117154c93539e33161dd318e6aeb8c04efa <b94538186a3eae3763b8f96dacd610920a865aa7 || >=57a9a117154c93539e33161dd318e6aeb8c04efa <0680f511926589206f81f57f76ce131d7741a316 || >=57a9a117154c93539e33161dd318e6aeb8c04efa <8bcd15b690a390241179516af1b6ae49ebfd9d95 || >=57a9a117154c93539e33161dd318e6aeb8c04efa <9ce754ed8e7ab4e3999767ce1505f85c449ccb07 | 1716b7fea2ead941a0dfac06c4504a3437cdf00d, dab9f93251b2c86a033de6098d0c73afddd55d4a, b94538186a3eae3763b8f96dacd610920a865aa7, 0680f511926589206f81f57f76ce131d7741a316, 8bcd15b690a390241179516af1b6ae49ebfd9d95, 9ce754ed8e7ab4e3999767ce1505f85c449ccb07 |
| Linux/Linuxgeneric | 4.12 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid_bits. Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic_its_restore_itt(), where the unchecked value can be converted into an oversized scan_its_table() range.
Quoted source text, attributed separately from HOL analysis.