CVE-2026-64105: Linux Kernel Privilege Escalation Flaw

CVE-2026-64105 Overview

CVE-2026-64105 is a Linux kernel vulnerability affecting the KVM (Kernel-based Virtual Machine) arm64 virtual Generic Interrupt Controller (vGIC) subsystem. The flaw resides in the vCPU creation path where kvm_vgic_vcpu_init() failures do not release previously allocated private interrupt request (IRQ) resources. When a redistributor iodev registration fails after private IRQs are allocated, the kernel skips the required kvm_vgic_vcpu_destroy() cleanup call. The issue is a companion to commit 250f25367b58 ("KVM: arm64: Tear down vGIC on failed vCPU creation") which fixed the adjacent kvm_share_hyp() failure path but missed this symmetric case.

Critical Impact
Memory leak of private IRQ structures on arm64 virtualization hosts when vCPU initialization fails, potentially exhausting kernel resources under repeated failure conditions.

Affected Products

Linux kernel with KVM enabled on arm64 architecture
Linux stable branches containing the KVM arm64 vGIC subsystem prior to the fix
Virtualization hosts running arm64 guests through KVM

Discovery Timeline

2026-07-19 - CVE-2026-64105 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64105

Vulnerability Analysis

The vulnerability exists in the arm64 KVM vGIC initialization sequence within kvm_arch_vcpu_create(). When creating a new vCPU, the kernel calls kvm_vgic_vcpu_init() to allocate private IRQs (SGIs and PPIs) and register the redistributor iodev. If the redistributor iodev registration fails after private IRQs have already been allocated, the function returns an error without freeing those IRQs.

The missing cleanup means the failed vCPU is freed while its allocated private interrupt structures remain referenced in kernel memory. This is classified as a memory leak vulnerability [CWE-401] in a kernel subsystem. Repeated triggering of this failure path can gradually exhaust kernel memory on affected hosts.

Root Cause

The root cause is an incomplete error-handling path in the KVM arm64 vGIC initialization code. The prior fix in commit 250f25367b58 added kvm_vgic_vcpu_destroy() to the kvm_share_hyp() failure path but did not apply the same cleanup to the immediately adjacent kvm_vgic_vcpu_init() failure path. Both paths share identical shape and require the same teardown to release private IRQs.

Attack Vector

Triggering the flaw requires the ability to create vCPUs through the KVM interface, typically available to a privileged user or virtualization management process on the host. An attacker with local access to /dev/kvm can repeatedly attempt vCPU creation under conditions that induce redistributor iodev registration failure. Each failed attempt leaks the private IRQ allocations, gradually consuming kernel memory and potentially leading to denial of service.

No verified exploit code is publicly available. The fix adds the missing kvm_vgic_vcpu_destroy() call so that private IRQs allocated before a redistributor iodev registration failure are released before the failed vCPU is freed.

Detection Methods for CVE-2026-64105

Indicators of Compromise

Unexplained growth in kernel slab allocations related to vgic_irq structures on arm64 KVM hosts
Repeated kvm_vgic_vcpu_init() failures in kernel logs correlated with virtual machine lifecycle events
Progressive kernel memory exhaustion on arm64 hosts running KVM workloads without corresponding guest memory pressure

Detection Strategies

Monitor /proc/slabinfo for anomalous growth in KVM and vGIC-related slab caches over time
Audit kernel logs (dmesg, journalctl -k) for KVM vCPU creation failures and redistributor registration errors
Compare running kernel versions against the fixed commits (173fb86e5519, 7023900b4988, e690caa54a61, f19c354dbd45) to identify unpatched hosts

Monitoring Recommendations

Track vCPU creation success and failure rates through hypervisor management logs
Alert on sustained kernel memory growth on arm64 virtualization hosts without matching workload increases
Log and review all invocations of KVM ioctls from non-privileged or unexpected processes

How to Mitigate CVE-2026-64105

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable branch commits 173fb86e5519, 7023900b4988, e690caa54a61, and f19c354dbd45
Update to a distribution kernel that incorporates the KVM arm64 vGIC cleanup fix
Restrict access to /dev/kvm to trusted virtualization management accounts only

Patch Information

The fix adds a call to kvm_vgic_vcpu_destroy() in the kvm_vgic_vcpu_init() failure path within kvm_arch_vcpu_create(). The patch is available across multiple stable kernel branches through the following commits: Kernel Git Commit Change, Kernel Git Commit Update, Kernel Git Commit Patch, and Kernel Git Commit Fix.

Workarounds

Limit KVM access to trusted administrators until patches are applied to reduce the attack surface for triggering the failure path
Reboot affected arm64 KVM hosts periodically to reclaim leaked kernel memory as a temporary measure
Monitor kernel memory usage and set alerting thresholds to catch resource exhaustion before service impact

bash

# Verify running kernel version and check for the fix
uname -r

# Check for the presence of the fix commits in kernel source (if available)
git log --oneline | grep -E "173fb86e5519|7023900b4988|e690caa54a61|f19c354dbd45"

# Restrict /dev/kvm access to the kvm group only
ls -l /dev/kvm
chmod 660 /dev/kvm
chown root:kvm /dev/kvm