CVE-2026-64106
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid_bits. Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic_its_restore_itt(), where the unchecked value can be converted into an oversized scan_its_table() range.
Affected versions
Linux kernel versions
4.12
and later are affected. Fixed in
6.1.175,
6.6.142,
6.12.92,
6.18.34,
7.0.11,
7.1
and their respective stable series.
References
6 totalFrequently asked questions
-
What is CVE-2026-64106?
CVE-2026-64106 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.12 onward and has been patched in 6.1.175, 6.6.142, 6.12.92 and others. CVE-2026-64106 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64106?
Yes — CVE-2026-64106 has been patched. Fixed versions include 6.1.175, 6.6.142, 6.12.92 and others. If you are running Linux kernel 4.12 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64106 actively exploited?
No — CVE-2026-64106 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.