CVE-2026-64287

An out-of-bounds access flaw rated IMPORTANT was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem on ARM64 systems, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10 and the kernel packages in Red Hat In-Vehicle OS. When flushing the pKVM hypervisor's private vCPU state, flush_hyp_vcpu() copies the host vGIC state verbatim without enforcing that used_lrs stays within the number of implemented list registers, as the vGIC list register save and restore code expects. A highly privileged local attacker on the host could supply a crafted used_lrs value that is used at EL2 to index vgic_lr[] and access the ICH_LR_EL2 registers out of bounds, allowing the attacker to read or write sensitive hypervisor memory, potentially leading to privilege escalation or a system crash (denial of service). Red Hat rated this flaw as IMPORTANT with a CVSS score of 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the CVE.org score of 8.2, reflecting the high attack complexity and the local privileges required to manipulate the vGIC state. Fixes are being pursued through the affected product streams. Red Hat Enterprise Linux 6 and 7 ELS and the RHEL 9.2 z-stream kernels are not affected because the vulnerable code is not present.