CVE-2026-64106: Linux Kernel Privilege Escalation Flaw

CVE-2026-64106 Overview

CVE-2026-64106 is a Linux kernel vulnerability in the KVM arm64 virtual GIC ITS (Interrupt Translation Service) subsystem. The flaw resides in vgic_its_restore_dte(), which fails to validate the num_eventid_bits field when userspace restores an ITS Device Table Entry (DTE). While the live MAPD path rejects DTE Size fields encoding more EventID bits than the virtual ITS supports, the restore path accepts them and stores the out-of-range value in dev->num_eventid_bits. The unchecked value later reaches vgic_its_restore_itt(), where it can be converted into an oversized scan_its_table() range.

Critical Impact
A local attacker with permission to interact with KVM can trigger out-of-bounds memory access in the host kernel, leading to denial of service or potential memory corruption on ARM64 hypervisors.

Affected Products

Linux kernel (KVM arm64 subsystem, vgic-its component)
ARM64 hypervisor hosts running virtual machines with emulated GICv3 ITS
Linux stable branches referenced by upstream fix commits

Discovery Timeline

2026-07-19 - CVE-2026-64106 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64106

Vulnerability Analysis

The vulnerability affects the virtual GIC ITS implementation in KVM on arm64. The virtual ITS advertises a maximum EventID width through VITS_TYPER_IDBITS. When a guest issues a MAPD command through the live command path, the kernel rejects any Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports.

Userspace can also restore ITS state through the KVM device save/restore interface. The restore path in vgic_its_restore_dte() omits this bounds check. As a result, an attacker-controlled num_eventid_bits value is stored directly on the device object.

The stored value then feeds into vgic_its_restore_itt(), which computes a scan range for scan_its_table(). An oversized value produces an oversized scan range that reads beyond the intended in-memory ITS table region.

Root Cause

The root cause is missing input validation [Improper Input Validation] on data supplied through the KVM ITS restore ioctl. The MAPD command handler validated the EventID width, but the restore code path performing an equivalent state install did not mirror that check before allocating the device structure.

Attack Vector

Exploitation requires local access with privileges to open /dev/kvm and issue ITS device attribute ioctls (typically the qemu/libvirt user or a VMM process). An attacker crafts a saved ITS state containing a DTE with a Size field larger than VITS_TYPER_IDBITS - 1. Loading that state triggers the oversized table scan and reads memory outside the intended range, impacting host kernel integrity and availability.

No verified proof-of-concept code is publicly available. Technical details are documented in the upstream kernel commits referenced below.

Detection Methods for CVE-2026-64106

Indicators of Compromise

Unexpected KVM guest crashes or host kernel oops originating in vgic-its.c functions such as vgic_its_restore_dte, vgic_its_restore_itt, or scan_its_table.
KASAN or slab out-of-bounds warnings in kernel logs referencing the vGIC ITS code paths.
Anomalous VM migration or snapshot restore operations preceding kernel instability on arm64 hosts.

Detection Strategies

Audit kernel versions on all arm64 KVM hypervisors and compare against the fixed commits listed in the patch information section.
Monitor dmesg and journal logs for arm64-specific vGIC ITS warnings, BUG reports, or KASAN splats.
Inspect VMM (qemu, libvirt) audit trails for VM state restore or migration events from untrusted sources.

Monitoring Recommendations

Forward kernel logs from arm64 hypervisors into a centralized log store and alert on vgic_its_ symbol references or KVM subsystem panics.
Track which users and services can access /dev/kvm and issue KVM_SET_DEVICE_ATTR ioctls against KVM_DEV_TYPE_ARM_VGIC_ITS.
Baseline expected VM snapshot and live-migration workflows so out-of-band restore attempts stand out.

How to Mitigate CVE-2026-64106

Immediate Actions Required

Apply the upstream Linux kernel patches referenced below to all arm64 hosts running KVM.
Restrict /dev/kvm access to trusted VMM service accounts and remove unnecessary users from the kvm group.
Reject VM state files, snapshots, and live-migration streams from untrusted origins until hosts are patched.

Patch Information

The issue is resolved by adding a bounds check in vgic_its_restore_dte() that rejects DTEs where num_eventid_bits > VITS_TYPER_IDBITS before device allocation. Fixes are available in the following upstream commits: Linux Kernel Commit 0680f51, Linux Kernel Commit 1716b7fe, Linux Kernel Commit 8bcd15b6, Linux Kernel Commit 9ce754ed, Linux Kernel Commit b9453818, and Linux Kernel Commit dab9f932. Consume the fix through your distribution's kernel security update channel.

Workarounds

Avoid restoring or live-migrating VM state from untrusted sources onto unpatched arm64 KVM hosts.
Where feasible, disable ITS emulation for guests that do not require it, reducing exposure of the vgic-its restore path.
Enforce least-privilege on VMM processes so that a compromised guest orchestration user cannot invoke KVM device ioctls on the host.

bash

# Verify kernel version and confirm the fix is present on Debian/Ubuntu
uname -r
apt-cache policy linux-image-$(uname -r)

# Restrict /dev/kvm access to a dedicated group
ls -l /dev/kvm
sudo setfacl -m g:kvm:rw /dev/kvm
sudo gpasswd -d <untrusted-user> kvm