CVE-2026-64283: Linux Kernel Privilege Escalation Flaw

CVE-2026-64283 Overview

CVE-2026-64283 is a signed integer handling flaw in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem. The vulnerability lives in the guest_memfd memslot binding logic, where the offset and size arguments are treated as signed loff_t values instead of unsigned uoff_t values. When the offset is near the maximum positive 64-bit value, adding the size produces a negative signed sum. That negative sum bypasses the offset + size > i_size_read(inode) bounds check, allowing an out-of-range binding to be accepted by KVM.

Critical Impact
A local user able to invoke KVM guest_memfd ioctls can bind a memslot with an out-of-bounds offset, corrupting guest memory bookkeeping in the host kernel.

Affected Products

Linux kernel branches containing the KVM guest_memfd memslot binding code prior to the fix commits eba85fee7fc6 and f3a98d5881b9
Distributions shipping vulnerable KVM builds on 64-bit hosts
Virtualization platforms relying on KVM guest_memfd for confidential guest memory backing

Discovery Timeline

2026-07-25 - CVE-2026-64283 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64283

Vulnerability Analysis

On 64-bit kernels, guest_memfd tracks the number of pages in a memslot as unsigned 64-bit values. The binding path, however, accepted the offset and size as loff_t, a signed 64-bit type. This implicit conversion transforms sufficiently large unsigned values into negative signed values. The result is a numeric truncation and sign-boundary error [CWE-681, CWE-195] in the overflow check.

Root Cause

KVM restricts a memslot's page count to KVM_MEM_MAX_NR_PAGES, capped at the largest positive signed 32-bit value, so the size itself is bounded at 0x7fffffff000. The offset, in contrast, is unchecked until the final offset + size > i_size_read(inode) comparison. When the offset approaches the top of the positive 64-bit range, the signed sum wraps into a negative value. Because i_size_read() returns a positive size, the negative sum always compares as smaller, and the check silently passes.

Attack Vector

Exploitation requires local access with permission to invoke KVM ioctls, typically via /dev/kvm. An attacker with rights to create virtual machines can submit a crafted memslot binding request against a guest_memfd file with an offset near LLONG_MAX. KVM will accept the binding despite it lying outside the file. See the upstream fixes at kernel.org commit eba85fee7fc6 and kernel.org commit f3a98d5881b9 for the exact code paths. No public proof-of-concept has been published.

Detection Methods for CVE-2026-64283

Indicators of Compromise

Unexpected KVM_SET_USER_MEMORY_REGION2 or guest_memfd ioctl calls from processes that do not normally manage virtual machines
Kernel warnings, oops messages, or memory-management traces originating from KVM guest_memfd code paths
Non-root or unprivileged accounts opening /dev/kvm outside of sanctioned hypervisor workloads

Detection Strategies

Audit /dev/kvm access with Linux Audit (auditctl -w /dev/kvm -p rwa) and forward events to a central log store
Collect kernel ring-buffer messages and alert on KVM subsystem faults following ioctl activity
Track running kernel versions across hosts and flag those missing the fix commits

Monitoring Recommendations

Baseline which service accounts and container runtimes legitimately touch /dev/kvm, then alert on deviations
Monitor for anomalous VM creation patterns from unexpected users or namespaces
Correlate kernel-level virtualization telemetry with process ancestry to identify unauthorized KVM consumers

How to Mitigate CVE-2026-64283

Immediate Actions Required

Apply vendor kernel updates that include commits eba85fee7fc6 and f3a98d5881b9
Restrict /dev/kvm access to trusted hypervisor accounts and remove unnecessary group memberships
Inventory hosts running KVM with guest_memfd enabled and prioritize patching those exposed to multi-tenant workloads

Patch Information

Upstream fixes change the memslot binding path to treat offset and size as unsigned values, eliminating the signed overflow in the bounds check. Missing includes were also added to kvm_mm.h. The relevant commits are available at kernel.org commit eba85fee7fc6 and kernel.org commit f3a98d5881b9. Consult your Linux distribution's advisory tracker for backported package versions.

Workarounds

Disable guest_memfd-backed virtual machines on hosts where the feature is not required
Enforce strict permissions on /dev/kvm so only vetted virtualization daemons can invoke KVM ioctls
Constrain untrusted workloads with mandatory access controls such as SELinux or AppArmor to block direct KVM access

bash

# Verify running kernel and remove broad access to /dev/kvm
uname -r
ls -l /dev/kvm
sudo chown root:kvm /dev/kvm
sudo chmod 0660 /dev/kvm
getent group kvm