CVE-2026-64284: Linux Kernel Privilege Escalation Flaw

CVE-2026-64284 Overview

CVE-2026-64284 is a Linux kernel vulnerability in the Kernel-based Virtual Machine (KVM) subsystem for x86. The flaw affects the handling of fastpath userspace exits, where vendor-specific exit operations were not consistently executed before control returned to userspace. For Intel VMX (and pending SVM changes), KVM must flush the Page Modification Logging (PML) buffer before exiting to userspace. Failure to do so risks leaving memory written during the final KVM_RUN unflagged as dirty, corrupting dirty-page tracking used for live migration and memory snapshotting.

Critical Impact
A local attacker with vCPU access can cause guest memory writes to escape dirty-page tracking, undermining live migration integrity and availability of virtualized workloads.

Affected Products

Linux kernel — KVM x86 subsystem (VMX/Intel and SVM/AMD code paths)
Distributions shipping vulnerable Linux kernel builds prior to the referenced upstream commits
Virtualization hosts using KVM for guest execution and live migration

Discovery Timeline

2026-07-25 - CVE-2026-64284 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64284

Vulnerability Analysis

The vulnerability resides in KVM's x86 fastpath userspace exit logic. When a vCPU exits to userspace via the fastpath, KVM previously handled the exit in common architecture code without giving vendor code an opportunity to run required cleanup. On VMX hosts, this means the PML buffer, which records guest physical addresses written by the guest, was not flushed before returning to userspace.

Any memory written by the final KVM_RUN invocation could remain unrecorded in the dirty-page bitmap. Consumers of dirty-page tracking, such as QEMU's live migration logic and checkpoint/restore tooling, receive an incomplete view of guest state. The result is silent data divergence between source and destination hosts during migration.

The upstream fix moves fastpath userspace exit handling into vendor code so that VMX (and forthcoming SVM changes) can flush PML and perform related bookkeeping before userspace regains control of the vCPU.

Root Cause

The root cause is a Kernel Vulnerability in the ordering of exit operations. Common KVM code invoked the fastpath userspace exit without dispatching to vendor-specific handlers. Vendor state that must be synchronized on every exit path, including the PML buffer for VMX, was skipped.

Attack Vector

Exploitation requires local access with the ability to run a KVM guest, typically through /dev/kvm. A malicious or compromised userspace VMM can drive guests through fastpath exits to trigger memory writes that never surface in dirty-page tracking. The attack vector is local with low privileges and no user interaction, targeting integrity and availability of virtualized workloads.

No verified public exploit code is available. See the upstream commits for technical details: kernel commit 0ffedf43910e, kernel commit 4ad73ef0e796, kernel commit b3436d9b9b1a, and kernel commit f2ca2b532621.

Detection Methods for CVE-2026-64284

Indicators of Compromise

Discrepancies between source and destination guest memory after KVM live migration on unpatched hosts.
Corruption or unexplained state loss inside guests following migration or checkpoint/restore cycles.
Kernel builds on virtualization hosts predating the referenced upstream KVM commits.

Detection Strategies

Inventory hypervisor hosts and compare running kernel versions against distribution advisories tracking the KVM fastpath exit fix.
Audit access to /dev/kvm and identify unprivileged processes or containers permitted to create vCPUs.
Validate live migration integrity by hashing guest memory pre- and post-migration in controlled test environments.

Monitoring Recommendations

Alert on unexpected users or services opening /dev/kvm or issuing KVM_RUN ioctls outside sanctioned virtualization stacks.
Track kernel package versions across the fleet and flag KVM hosts running unpatched builds.
Monitor QEMU and libvirt logs for migration failures, checksum mismatches, or dirty-tracking anomalies.

How to Mitigate CVE-2026-64284

Immediate Actions Required

Apply the vendor kernel update that includes the upstream KVM fastpath exit handler fix on all virtualization hosts.
Restrict /dev/kvm access to trusted virtualization services and administrators only.
Defer non-essential live migrations on unpatched hosts until kernels are updated.

Patch Information

The fix moves fastpath userspace exit handling into vendor code so VMX flushes the PML buffer before returning to userspace. Apply the changes referenced by upstream commits 0ffedf43910e, 4ad73ef0e796, b3436d9b9b1a, and f2ca2b532621, or install the corresponding kernel package from your Linux distribution.

Workarounds

Disable PML on affected VMX hosts by loading the kvm_intel module with pml=0, accepting the performance cost of software dirty tracking.
Avoid relying on live migration or dirty-page snapshotting on unpatched hosts.
Limit guest creation privileges to reduce the population of users who can drive vCPUs into fastpath exits.

bash

# Verify kernel version and PML status on a KVM host
uname -r
cat /sys/module/kvm_intel/parameters/pml

# Temporarily disable PML until the host kernel is patched
sudo modprobe -r kvm_intel
sudo modprobe kvm_intel pml=0