CVE-2026-64106
A critical flaw in the Linux kernel’s virtual interrupt controller (VGIC) allows a user to restore a device table entry with an invalid number of event ID bits. This can lead to memory corruption and loss of system availability. The issue has been fixed in the kernel.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, specifically the KVM arm64 VGIC ITS component. Users running older kernel versions that have not applied the patch are affected.
Real-world impact
An attacker could cause a system crash or denial of service by restoring a malformed ITS entry, potentially disrupting virtual machines.
Why this severity
The CVSS score of 9 reflects local access, no privilege needed, no user interaction, and the impact is high availability loss. The flaw allows an attacker to cause a crash, which is a severe consequence.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the fix for CVE-2026-64106.
NVD description indicates fix
Timeline
- Jul 19, 2026 · 14d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.