CVE-2026-64282: Linux Kernel Race Condition Vulnerability

CVE-2026-64282 Overview

CVE-2026-64282 is a Linux kernel vulnerability in the Kernel-based Virtual Machine (KVM) subsystem for the arm64 architecture. The flaw resides in kvm_translate_vncr(), which fails to release a Page Frame Number (PFN) reference when it races with a Memory Management Unit (MMU) notifier. When the race triggers the early-return path, the faulted-in PFN retains its acquired reference, producing a memory leak inside the host kernel. The upstream fix adds the missing kvm_release_faultin_page() call for the unused PFN.

Critical Impact
Repeated triggering of the race condition by a guest can exhaust host memory resources, degrading virtualization host stability over time.

Affected Products

Linux kernel with KVM support on the arm64 architecture
Distributions shipping affected stable kernel branches prior to the referenced fix commits
Virtualization hosts running arm64 guests with Nested Virtualization / VNCR page translation enabled

Discovery Timeline

2026-07-25 - CVE-2026-64282 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64282

Vulnerability Analysis

The defect is a memory leak in the arm64 KVM stage-2 fault handling path. kvm_translate_vncr() performs a guest-physical to host-physical translation and pins the target page by acquiring a PFN reference through the fault-in machinery. If an MMU notifier fires concurrently and invalidates the translation window, the function takes an early-return branch to abort the operation. That branch omits the corresponding release, so the reference count on the previously faulted-in page is never decremented.

Each occurrence of the race leaks one page reference. Under sustained guest activity that exercises Virtual Nested Control Register (VNCR) translation while the host executes operations that generate MMU notifier callbacks, such as memory reclaim, compaction, or KSM merging, the leak accumulates.

Root Cause

The root cause is a missing cleanup call on a rare control-flow path. The corrected code inserts kvm_release_faultin_page() before the early return so the PFN reference obtained during fault-in is properly balanced. The pattern is a classic resource-management error: an acquisition on one branch lacks a matching release on an exceptional branch.

Attack Vector

Exploitation requires code execution inside an arm64 KVM guest capable of driving kvm_translate_vncr() while the host produces MMU notifier events. A guest cannot directly control notifier timing, so triggering the race is probabilistic. Repeated attempts amplify the leak and can lead to host resource exhaustion, a denial-of-service condition against the hypervisor. No privilege escalation or information disclosure vectors are identified in the upstream advisory.

Code-level details are available in the upstream fixes at Linux Kernel Commit 0c93681, Linux Kernel Commit 9f76b03, and Linux Kernel Commit cd1067cc.

Detection Methods for CVE-2026-64282

Indicators of Compromise

Steady, unexplained decline in host free memory on arm64 KVM hypervisors running long-lived guests
Growth in kernel page reference counters for guest-backing memory that does not correlate with guest working set expansion
Out-of-memory (OOM) events on the host while guest memory pressure appears normal

Detection Strategies

Compare running kernel versions against the fixed stable commits referenced by the upstream advisory
Track /proc/meminfo and per-NUMA node statistics on arm64 KVM hosts to identify slow memory drift
Enable kernel tracepoints on the KVM stage-2 fault path and MMU notifier callbacks to correlate races with reference count growth

Monitoring Recommendations

Alert on host memory utilization trending upward without matching guest workload change on arm64 virtualization fleets
Monitor kernel logs for OOM killer activity, KVM warnings, and stage-2 mapping errors
Inventory arm64 hypervisor kernels and flag any running versions that predate the referenced fix commits

How to Mitigate CVE-2026-64282

Immediate Actions Required

Update arm64 KVM hosts to a Linux kernel that includes the fix commits 0c93681, 9f76b03, or cd1067cc
Prioritize patching on hosts running untrusted arm64 guests or high guest density
Schedule live migration or restart of long-running guests to reclaim already-leaked pages after the host is patched

Patch Information

The upstream fix adds a call to kvm_release_faultin_page() on the early-return path in kvm_translate_vncr(). Apply the stable-tree patches referenced in the advisory: Linux Kernel Commit 0c93681, Linux Kernel Commit 9f76b03, and Linux Kernel Commit cd1067cc. Distribution-specific kernel updates should be tracked through the relevant vendor advisories.

Workarounds

No supported workaround eliminates the leak; only the kernel patch resolves the root cause
Reduce exposure by restricting untrusted guests on arm64 hosts and periodically rebooting hypervisors to reclaim leaked pages
Where feasible, avoid features that rely on VNCR translation on unpatched kernels until updates are deployed

bash

# Verify running kernel and confirm the fix is present after patching
uname -r
# On distributions using dpkg
dpkg -l | grep linux-image
# On distributions using rpm
rpm -qa | grep kernel
# Confirm the fix commit is included in the source tree used for the running kernel
git -C /usr/src/linux log --oneline | grep -E '0c93681|9f76b03|cd1067cc'