CVE-2026-64287: Linux Kernel Privilege Escalation Flaw

CVE-2026-64287 Overview

CVE-2026-64287 is a Linux kernel vulnerability in the KVM arm64 protected KVM (pKVM) subsystem. The flaw exists in flush_hyp_vcpu(), which copies host vGIC (virtual Generic Interrupt Controller) state into the hypervisor's private vCPU on every run. The function does not bound used_lrs to the number of implemented list registers before it is used at EL2 to index vgic_lr[] and access ICH_LR<n>_EL2 registers. A malicious host can supply an out-of-range value that is consumed by the trusted EL2 hypervisor, crossing the host-to-EL2 trust boundary.

Critical Impact
A privileged host actor can cross the pKVM host-to-EL2 trust boundary and achieve out-of-bounds indexing inside the protected hypervisor, compromising confidentiality, integrity, and availability of protected guests.

Affected Products

Linux kernel builds with KVM arm64 and protected KVM (pKVM) enabled
ARM64 systems using GICv3 virtualization via KVM
Distributions shipping the affected upstream KVM arm64 code prior to the referenced fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64287 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64287

Vulnerability Analysis

The vulnerability resides in the KVM arm64 pKVM hypervisor code path that handles virtual interrupt controller state transitions. On every vCPU run, flush_hyp_vcpu() copies the host-managed vgic_v3 structure verbatim into the hypervisor's private per-vCPU state at Exception Level 2 (EL2). The used_lrs field of that structure serves as the loop bound for saving and restoring GICv3 list registers.

The trusted save and restore routines assume used_lrs stays within the number of implemented list registers. flush_hyp_vcpu() does not enforce that invariant. Because pKVM is designed to protect guest state even from a compromised host kernel, any host-controlled value that reaches EL2 without validation breaks the pKVM threat model.

Root Cause

The root cause is missing input validation on the used_lrs field after it crosses the host-to-EL2 trust boundary. This is an out-of-bounds indexing flaw driven by unchecked input from a less-trusted layer. The fix clamps used_lrs to the implemented list register count after the copy, mirroring the check already present in vgic_flush_lr_state(). The register count is constant after initialization, so it is cached once from kvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr to avoid repeated reads on entry.

Attack Vector

Exploitation requires local, high-privilege code execution on the host kernel to control the vGIC state passed to EL2. An attacker with kernel-level access on the host can set used_lrs beyond the physical list register count. When flush_hyp_vcpu() copies the structure, EL2 code uses the attacker-controlled index to access vgic_lr[] and program ICH_LR<n>_EL2 system registers. This defeats the isolation pKVM provides to protected guests. See the kernel patch series for the corrective code path.

No verified public exploit code is available. The vulnerability is described in prose based on the upstream commit message.

Detection Methods for CVE-2026-64287

Indicators of Compromise

Unexpected EL2 hypervisor faults, aborts, or panics on ARM64 systems running pKVM
Anomalous KVM crash logs referencing vgic_v3, flush_hyp_vcpu, or list-register save/restore paths
Unexplained protected guest instability or state corruption on GICv3 hardware

Detection Strategies

Inventory ARM64 hosts running KVM with pKVM enabled and cross-reference kernel versions against the fix commits 2c5e72b, 7fca3fc, 8cc8bbf, 9fa301d, and c646431.
Monitor kernel ring buffer output (dmesg) for KVM and vGIC-related warnings that could indicate probing of the vulnerable path.
Correlate host kernel-module loads and privileged process activity on virtualization hosts with subsequent guest instability.

Monitoring Recommendations

Forward host kernel logs and KVM subsystem events to a centralized analytics platform for long-term correlation.
Alert on privilege changes and loadable kernel module events on hypervisor hosts, since exploitation requires host kernel privileges.
Track integrity of pKVM-protected guests using platform attestation where available.

How to Mitigate CVE-2026-64287

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 2c5e72b, 7fca3fc, 8cc8bbf, 9fa301d, and c646431 to all affected ARM64 hosts running pKVM.
Restrict CAP_SYS_ADMIN, kernel module loading, and other host-kernel-privilege paths to the minimum required set of operators.
Rebuild and redeploy custom kernels used on ARM64 virtualization hosts after picking up the fix.

Patch Information

The fix clamps used_lrs to the implemented list register count inside the hypervisor after the host-provided structure is copied, and caches nr_lr into hyp_gicv3_nr_lr at initialization. Corresponding stable-tree commits are published at kernel.org commit 2c5e72b, commit 7fca3fc, commit 8cc8bbf, commit 9fa301d, and commit c646431. Consume vendor-supplied kernel updates from your distribution once they include these commits.

Workarounds

Disable protected KVM on affected ARM64 hosts if the pKVM isolation guarantee is not required for the workload.
Limit the set of users and services that can load kernel modules or run privileged code on hypervisor hosts.
Isolate high-value protected guests onto hosts that have already received the patched kernel.

bash

# Verify running kernel and confirm the fix is present
uname -r
git log --oneline | grep -E "2c5e72b|7fca3fc|8cc8bbf|9fa301d|c646431"

# Check whether pKVM is enabled at boot
grep -E "kvm-arm.mode|protected" /proc/cmdline
dmesg | grep -i "protected kvm\|pKVM"