CVE-2026-64106

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for arm64 architecture, specifically within the virtual Generic Interrupt Controller (vgic-its) module. A local user in userspace can restore an Interrupt Translation Service (ITS) Device Table Entry (DTE) with a size field that specifies more EventID bits than the virtual ITS supports. This unchecked value can lead to an oversized scan of the ITS table, potentially causing system instability or a denial of service.

A malformed KVM arm64 VGIC ITS restore state can provide a Device Table Entry with num_eventid_bits larger than the virtual ITS supports. The live MAPD path rejects this state, but the restore path could accept it and later use the value to build an oversized scan_its_table range during ITT restore. For the CVSS the PR:L because a local user or VM management process with access to KVM restore ioctls can supply the restored device state, and full administrator privileges are not necessarily required when /dev/kvm access is delegated. The issue is not network reachable and is triggered through the local KVM control plane rather than guest packet or interrupt traffic. Impact is mainly denial of service through excessive kernel work or a stalled restore path on the host. No direct C or I impact is assigned because the observable primitive is an oversized scan range rather than UAF, OOB write, or information leak.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.